1 DAVID F. MCDOWELL (CA SBN 125806) …...Abrego v. Dow Chem. Co., 443 F.3d 676, 683 (9th Cir....

ADIDAS AMERICA, INC.’S NOTICE OF REMOVAL TO FEDERAL COURT CASE NO. sf-3932098

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

DAVID F. MCDOWELL (CA SBN 125806) [email protected] MORRISON & FOERSTER LLP 707 Wilshire Boulevard Los Angeles, California 90017-3543 Telephone: 213.892-5200 Facsimile: 213.892-5454

ALEXANDRA E. LAKS (CA SBN 291861) [email protected] MORRISON & FOERSTER LLP 425 Market Street San Francisco, CA 94105-2482 Telephone: 415.268-7000 Facsimile: 415.268-7522

Attorneys for Defendant ADIDAS AMERICA, INC.

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF CALIFORNIA

CHRISTIAN DUKE, on behalf of himself and all others similarly situated,

Plaintiff,

v.

adidas AMERICA, INC.,

Defendant.

Case No. _____________________

NOTICE OF REMOVAL OF ACTION TO FEDERAL COURT BY DEFENDANT ADIDAS AMERICA, INC.

Complaint Filed: July 3, 2018

'18CV2081 NLSLAB

Case 3:18-cv-02081-LAB-NLS Document 1 Filed 09/07/18 PageID.1 of 8

ADIDAS AMERICA, INC.’S NOTICE OF REMOVAL TO FEDERAL COURT CASE NO. 1sf-3932098

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

DEFENDANT ADIDAS AMERICA, INC.’S NOTICE OF REMOVAL

PLEASE TAKE NOTICE that, pursuant to 28 U.S.C. § 1441, defendant

adidas America, Inc., (“Adidas”) hereby removes to this Court the state action

described below, which is within the original jurisdiction of this Court and properly

removed under 28 U.S.C. §§ 1332, 1441, 1446, and 1453. Pursuant to 28 U.S.C.

§ 1446(d), copies of this Notice of Removal are being served upon counsel for

Plaintiff Christian Duke and filed with the Clerk of the Superior Court of the

County of San Diego as an exhibit to a Notice of Filing. A copy of the Notice of

Filing is attached hereto (without exhibits) as Exhibit 1.

PROCEDURAL HISTORY AND TIMELINESS OF REMOVAL

1. On July 3, 2018, Plaintiff Christian Duke filed a purported class action

captioned Duke v. adidas America, Inc, Case No. 37-2018-00033037-CU-BT-CTL,

against Adidas in the Superior Court of the State of California, County of San

Diego (“State Court Action”).

2. Adidas was served with the State Court Action Summons and

Complaint on August 8, 2018. (See Ex. 2D.) Adidas’ removal notice is timely.

See 28 U.S.C. § 1446(b) (removal is timely if filed within 30 days of defendants’

receipt of the pleading). Pursuant to 28 U.S.C. § 1446(a), true and correct copies of

all process, pleadings, and orders served upon Adidas in the State Court Action are

attached to this Notice as Exhibit 2.

3. The San Diego County Superior Court is located within the Southern

District of California. 28 U.S.C. § 84(d). This Notice of Removal is therefore

properly filed in this Court pursuant to 28 U.S.C. § 1441(a).

ALLEGATIONS OF THE COMPLAINT

4. This action is a putative class action against Adidas on behalf of all

California citizens who are current or former Adidas consumers and “whose

“personal information and/or confidential information was compromised as a result

of a data breach announced by Adidas on or about June 28, 2018.” (Compl. ¶ 31,



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

attached as Exhibit 2A.) Plaintiff Christian Duke is a California citizen residing in

San Diego County. (Id. ¶ 6.) Plaintiff alleges that Adidas collects and maintains

personal information on its adidas.com website, that it undertook a duty to protect

such information as confidential, and that it breached that duty by failing to

implement reasonable security procedures. (Id. ¶¶ 3, 5.) Plaintiff claims that, as a

result of Adidas’ “failure to safeguard personal information” (id. ¶ 5), on or around

June 26, 2018, Adidas disclosed that hackers breached Adidas’ computer systems

and accessed contact information, usernames, and encrypted passwords of

consumers who made purchases via adidas.com/US (the “Incident”). (Id. ¶¶ 3-4.)

Plaintiff also alleges that Adidas failed to timely notify Plaintiff and class members

of the Incident. (Id. ¶¶ 30, 76.)

5. As a result of this alleged conduct, Plaintiff claims that he and class

members were injured because they (i) “face years of constant surveillance of their

financial and personal records, monitoring, and loss of rights” (Compl. ¶ 30); (ii)

lost money and property by purchasing identity theft protection services (id. ¶¶ 76,

87); and (iii) are subject to an increased risk for future identity theft and fraudulent

activity on their financial accounts. (Id. ¶ 87.)

6. Based on these allegations, Plaintiff seeks to bring claims on behalf of

the following class: All current and former consumers who made purchases on or through Adidas.com who are California citizens and whose personal and/or confidential information was compromised as a result of the data breach announced by Adidas on or about June 28, 2018.

(Id. ¶ 31.)

7. The Complaint purports to state claims for: (i) negligence; (ii) breach

of contract; (iii) breach of implied contract; (iv) violation of the California

Customer Records Act, Cal. Civ. Code § 1798.80 et seq.; and (v) for unlawful and

unfair business practices in violation of the California Unfair Competition Law

(UCL), Cal. Bus. & Prof. Code § 17200 et seq. Plaintiff seeks: (i) compensatory



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

and punitive damages (Compl. ¶ 56); (ii) “restitution for costs incurred associated

with the data breach and disgorgement of all profits accruing to Adidas because of

its unlawful and unfair business practices” (id. ¶ 89); (iii) statutory damages and

statutory penalties; (id. ¶ Prayer for Relief, d); and (iv) attorneys’ fees and costs.

(Id. ¶ Prayer for Relief, f.) Plaintiff also seeks equitable, injunctive, and declaratory

relief. (Id. ¶ Prayer for Relief, c.)

8. Adidas disputes Plaintiff’s allegations, believes the Complaint lacks

merit, and denies that Plaintiff or the putative class has been harmed in any way, or

that the class meets the requirements of Rule 23. Adidas assumes the truth of the

allegations for the purposes of removal only and reserves all defenses, motions, and

pleas.

BASIS FOR REMOVAL

9. This action is within the original jurisdiction of this Court, and

removal is therefore proper under the Class Action Fairness Act of 2005 (“CAFA”),

28 U.S.C. § 1332(d), which grants district courts original jurisdiction over covered

class actions in which the class has more than 100 members, the parties are

minimally diverse, and the amount in controversy exceeds $5,000,000. As set forth

below, this action satisfies each of the requirements of Section 1332(d)(2) for

original jurisdiction under CAFA, and may therefore be removed to this Court. See

Ibarra v. Manheim Invs., Inc., 775 F.3d 1193, 1195 (9th Cir. 2015); Bryant v. NCR

Corp., 284 F. Supp. 3d 1147, 1152 (S.D. Cal. 2018) (action properly removed

where CAFA requirements were satisfied).

10. Covered Class Action. This action meets the CAFA definition of a

class action: “any civil action filed under [R]ule 23 of the Federal Rules of Civil

Procedure or similar State statute or rule of judicial procedure.” 28 U.S.C.

§§ 1332(d)(1)(B), 1453(a) & (b). Here, Plaintiff filed the complaint as a class

action pursuant to California Code of Civil Procedure section 382 and California



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Rules of Court 3.765 (see Compl. ¶ 31) – state statutes similar to the Rule 23. The

action is accordingly a covered class action.

11. Class Action Consisting of More than 100 Members. Plaintiff

brings this purported class action on behalf of all citizens of California “who made

purchases on or through Adidas.com,” and “whose personal and/or confidential

information was compromised” as a result of the Incident. (Compl. ¶ 31.) Plaintiff

alleges that “numerous Californians” were affected by the Incident, as California is

a “larger ‘base’ than any other U.S. state” (id. ¶ 15), and that, while the exact

number of class members is unknown to him, Plaintiff believes the class size is

“significant.” (Id. ¶ 33.) Queries show that approximately 2,700,415 individuals

who made purchases through adidas.com/US are California residents. (See

Declaration of Allison Kruse (“Kruse Decl.”) ¶ 4.) Plaintiff alleges that all of these

accounts were “compromised.” (Compl. ¶ 5.) The aggregate number of putative

class members is greater than 100 persons for purposes of 28 U.S.C.

§ 1332(d)(5)(B).

12. Diversity. The required diversity of citizenship under CAFA is

satisfied because “any member of a class of plaintiffs is a citizen of a State different

from any defendant.” 28 U.S.C. § 1332(d)(2)(A). Plaintiff Christian Duke is a

citizen and resident of California. (Compl. ¶ 6.) adidas America, Inc. is

incorporated under the laws of Oregon, and its principal place of business is in

Oregon. (See Declaration of Kurt Tandan (“Tandan Decl.” ¶ 2.) As of the time of

removal, the citizenship of Adidas has not changed. Accordingly, a member of the

purported class in this case—Plaintiff Christian Duke—is a citizen of a state

(California) different from a defendant (Oregon), thus satisfying the diversity

requirements of 28 U.S.C. § 1332(d)(2)(A).

13. Amount in Controversy. Under CAFA, the claims of individual class

members are aggregated to determine if the amount in controversy exceeds the

required “sum or value of $5,000,000, exclusive of interest and costs.” 28 U.S.C.



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

§ 1332(d)(2), (6). “A removing defendant need only include a plausible allegation

that the amount in controversy exceeds the jurisdictional threshold, and the

defendant’s amount in controversy allegation should be accepted if not contested by

the plaintiff or questioned by the court.” Bryant, 284 F. Supp. 3d at 1149 (citing

Dart Cherokee Basin Operating Co., LLC v. Owens, 135 S. Ct. 547, 554 (2014)). If

the amount is contested and the complaint does not specify damages, the removing

defendant bears the burden of establishing the amount in controversy by a

“preponderance of the evidence.” Abrego v. Dow Chem. Co., 443 F.3d 676, 683

(9th Cir. 2006). “The demonstration concerns what the plaintiff is claiming . . . not

whether the plaintiff is likely to win or be awarded everything he seeks.” Brill v.

Countrywide Home Loans, Inc., 427 F.3d 446, 449 (7th Cir. 2005).

14. Without conceding any merit to the Complaint’s allegations, causes of

action or relief sought, the amount in controversy here satisfies this jurisdictional

threshold. Plaintiff seeks monetary relief in the form of: (i) compensatory and

punitive damages (Compl. ¶ 56); (ii) restitution and disgorgement (id. ¶ 89); (iii)

statutory damages and statutory penalties; (id. ¶ Prayer for Relief, d); and (iv)

attorneys’ fees and costs. (Id. ¶ Prayer for Relief, f.)

15. Plaintiff’s request for damages alone exceeds the $5,000,000

threshold. For example, Plaintiff seeks costs associated with purchasing identity

theft protection services and other “remedial” measures. (See, e.g., Compl. ¶ 76.)

The average cost of identity theft protection services across six sample plans is

$17.27 per month. (See Decl. of Alexandra Laks (“Laks Decl.”) ¶¶ 2-3, Ex. A.)

Multiplying this cost for a single month across approximately 2,700,415 class

members exceeds $5,000,000.

16. Plaintiff also demands damages for lost time associated with the “years

of constant surveillance of their financial and personal records, monitoring, and loss

of rights.” (Compl. ¶ 30.) The estimated cost of such damages exceeds the

$5,000,000 threshold as well. If Plaintiff’s and putative class members’



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

“surveillance and monitoring” time is valued at the California minimum wage

($11.00 per hour),1 and the “constant” “surveillance and monitoring” is estimated as

just one hour per class member, the potential amount in controversy exceeds

$15 million (1 hour x $11.00 per hour x 2,700,415 putative class members =

$29,704,565).

17. Plaintiff also requests punitive damages in connection with his

negligence claim. (See Compl. ¶ 56.) Punitive damages are considered part of the

amount in controversy. Guglielmino v. McKee Foods Corp., 506 F.3d 696, 700-

701 (9th Cir. 2007) (punitive damages properly considered in amount in

controversy). Punitive damages may be awarded for negligence in the context of

data breach litigation. Cf. In re Yahoo! Inc. Customer Data Sec. Breach Litig., 313

F. Supp. 3d 1113, 1148-49 (N.D. Cal. 2018) (denying dismissal of punitive

damages claims for alleged negligence, breach of implied good faith and fair

dealing, and violations of the Consumer Records Act in relation to security breach).

Considering Plaintiff’s alleged actual or compensatory damages in connection with

Plaintiff’s request for punitive damages, the amount in controversy is more than

satisfied.

18. Plaintiff’s request for restitution and disgorgement “of all profits

accruing to Adidas because of its unlawful and unfair business practices” (Compl.

¶ 89), statutory damages, and attorneys’ fees further pushes Plaintiff’s claims above

the $5,000,000 threshold. See, e.g., Gibson v. Chrysler Corp., 261 F.3d 927, 942-

43 (9th Cir. 2001) (attorneys’ fees are properly included in the amount in

controversy in a class action). While Adidas disputes that it is liable to Plaintiff or

the putative class, or that Plaintiff or the putative class suffered injury or incurred

1 See Minimum Wage, State of California Department of Industrial Relations,

https://www.dir.ca.gov/dlse/faq_minimumwage.htm (last accessed September 5, 2018).



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

damages in any amount, for purposes of CAFA, the matter in controversy exceeds

$5 million.

19. No CAFA Exclusions. The action does not fall within any exclusion

to removal jurisdiction recognized by 28 U.S.C. § 1332(d) because Adidas is not a

citizen of the State of California, the state in which the action was filed. Because

no other exclusion applies, this action is removable pursuant to CAFA, 28 U.S.C.

§§ 1332(d) and 1453(b).

DEMAND FOR JURY TRIAL

20. Adidas demands trial by jury on all issues raised in this action upon

which a jury trial is permitted.

CONCLUSION

21. For all of the reasons stated above, this action is within the original

jurisdiction of this Court pursuant to 28 U.S.C. § 1332(d). Accordingly, this action

is removable pursuant to 28 U.S.C. §§ 1332, 1441, 1446, and 1453.

WHEREFORE, Defendant Adidas gives notice that the above-described

action pending against it in the Superior Court of the County of San Diego,

California, is removed to this Court.

Dated: September 7, 2018

DAVID F. MCDOWELL ALEXANDRA E. LAKS MORRISON & FOERSTER LLP

By: /s/ David F. McDowell DAVID F. MCDOWELL



JS 44 (Rev. 06/17) CIVIL COVER SHEETThe JS 44 civil cover sheet and the information contained herein neither replace nor supplement the filing and service of pleadings or other papers as required by law, except asprovided by local rules of court. This form, approved by the Judicial Conference of the United States in September 1974, is required for the use of the Clerk of Court for thepurpose of initiating the civil docket sheet. (SEE INSTRUCTIONS ON NEXT PAGE OF THIS FORM.)

I. (a) PLAINTIFFS DEFENDANTS

(b) County of Residence of First Listed Plaintiff County of Residence of First Listed Defendant(EXCEPT IN U.S. PLAINTIFF CASES) (IN U.S. PLAINTIFF CASES ONLY)

NOTE: IN LAND CONDEMNATION CASES, USE THE LOCATION OF THE TRACT OF LAND INVOLVED.

(c) Attorneys (Firm Name, Address, and Telephone Number) Attorneys (If Known)

II. BASIS OF JURISDICTION (Place an “X” in One Box Only) III. CITIZENSHIP OF PRINCIPAL PARTIES (Place an “X” in One Box for Plaintiff(For Diversity Cases Only) and One Box for Defendant)

1 U.S. Government 3 Federal Question PTF DEF PTF DEFPlaintiff (U.S. Government Not a Party) Citizen of This State 1 1 Incorporated or Principal Place 4 4

of Business In This State

2 U.S. Government 4 Diversity Citizen of Another State 2 2 Incorporated and Principal Place 5 5Defendant (Indicate Citizenship of Parties in Item III) of Business In Another State

Citizen or Subject of a 3 3 Foreign Nation 6 6 Foreign Country

IV. NATURE OF SUIT (Place an “X” in One Box Only) Click here for: Nature of Suit Code Descriptions.CONTRACT TORTS FORFEITURE/PENALTY BANKRUPTCY OTHER STATUTES

110 Insurance PERSONAL INJURY PERSONAL INJURY 625 Drug Related Seizure 422 Appeal 28 USC 158 375 False Claims Act120 Marine 310 Airplane 365 Personal Injury - of Property 21 USC 881 423 Withdrawal 376 Qui Tam (31 USC 130 Miller Act 315 Airplane Product Product Liability 690 Other 28 USC 157 3729(a))140 Negotiable Instrument Liability 367 Health Care/ 400 State Reapportionment150 Recovery of Overpayment 320 Assault, Libel & Pharmaceutical PROPERTY RIGHTS 410 Antitrust

& Enforcement of Judgment Slander Personal Injury 820 Copyrights 430 Banks and Banking151 Medicare Act 330 Federal Employers’ Product Liability 830 Patent 450 Commerce152 Recovery of Defaulted Liability 368 Asbestos Personal 835 Patent - Abbreviated 460 Deportation

Student Loans 340 Marine Injury Product New Drug Application 470 Racketeer Influenced and (Excludes Veterans) 345 Marine Product Liability 840 Trademark Corrupt Organizations

153 Recovery of Overpayment Liability PERSONAL PROPERTY LABOR SOCIAL SECURITY 480 Consumer Credit of Veteran’s Benefits 350 Motor Vehicle 370 Other Fraud 710 Fair Labor Standards 861 HIA (1395ff) 490 Cable/Sat TV

160 Stockholders’ Suits 355 Motor Vehicle 371 Truth in Lending Act 862 Black Lung (923) 850 Securities/Commodities/190 Other Contract Product Liability 380 Other Personal 720 Labor/Management 863 DIWC/DIWW (405(g)) Exchange195 Contract Product Liability 360 Other Personal Property Damage Relations 864 SSID Title XVI 890 Other Statutory Actions196 Franchise Injury 385 Property Damage 740 Railway Labor Act 865 RSI (405(g)) 891 Agricultural Acts

362 Personal Injury - Product Liability 751 Family and Medical 893 Environmental Matters Medical Malpractice Leave Act 895 Freedom of Information

REAL PROPERTY CIVIL RIGHTS PRISONER PETITIONS 790 Other Labor Litigation FEDERAL TAX SUITS Act210 Land Condemnation 440 Other Civil Rights Habeas Corpus: 791 Employee Retirement 870 Taxes (U.S. Plaintiff 896 Arbitration220 Foreclosure 441 Voting 463 Alien Detainee Income Security Act or Defendant) 899 Administrative Procedure230 Rent Lease & Ejectment 442 Employment 510 Motions to Vacate 871 IRS—Third Party Act/Review or Appeal of240 Torts to Land 443 Housing/ Sentence 26 USC 7609 Agency Decision245 Tort Product Liability Accommodations 530 General 950 Constitutionality of290 All Other Real Property 445 Amer. w/Disabilities - 535 Death Penalty IMMIGRATION State Statutes

Employment Other: 462 Naturalization Application446 Amer. w/Disabilities - 540 Mandamus & Other 465 Other Immigration

Other 550 Civil Rights Actions448 Education 555 Prison Condition

560 Civil Detainee - Conditions of Confinement

V. ORIGIN (Place an “X” in One Box Only)1 Original

Proceeding2 Removed from

State Court 3 Remanded from

Appellate Court4 Reinstated or

Reopened 5 Transferred from

Another District(specify)

6 MultidistrictLitigation -Transfer

8 Multidistrict Litigation - Direct File

VI. CAUSE OF ACTIONCite the U.S. Civil Statute under which you are filing (Do not cite jurisdictional statutes unless diversity):

Brief description of cause:

VII. REQUESTED INCOMPLAINT:

CHECK IF THIS IS A CLASS ACTIONUNDER RULE 23, F.R.Cv.P.

DEMAND $ CHECK YES only if demanded in complaint:JURY DEMAND: Yes No

VIII. RELATED CASE(S)IF ANY (See instructions):

JUDGE DOCKET NUMBERDATE SIGNATURE OF ATTORNEY OF RECORD

FOR OFFICE USE ONLY

RECEIPT # AMOUNT APPLYING IFP JUDGE MAG. JUDGE

Christian Duke

San Diego County

Jeffrey R. Krinsk (109234) / Trenton R. Kashima (291405)Finkelstein & Krinsk LLP, 550 West C St., Suite 1760, San Diego, CA92101; Tel: (619) 238-1333

adidas America, Inc.

David F. McDowell (125806) / Alexandra E. Laks (291861)Morrison & Foerster LLP, 707 Wilshire Blvd., Suite 6000, Los Angeles,CA 90017; Tel: (213) 892-5200

28 U.S.C. § 1332

Purported class action arising out of alleged data security incident

09/07/2018 s/David F. McDowell

Exhibit 3 Page 37

'18CV2081 NLSLAB

Case 3:18-cv-02081-LAB-NLS Document 1-1 Filed 09/07/18 PageID.9 Page 1 of 1

EXHIBITS TO NOTICE OF REMOVAL

Ex. Description Page

1 Defendant adidas America, Inc.’s Notice of Filing Notice of Removal of Action to Federal Court, Case No. 37-2018-00033037-CU-BT-CTL (San Diego Super. Ct.) (without exhibits)

1

2 True and correct copies of all process, pleadings, and orders served upon Adidas in Case No. 37-2018-00033037-CU-BT-CTL (San Diego Super. Ct.)

4

3 Civil Cover Sheet 37


EXHIBIT 1


sf-3931919 1 ADIDAS AMERICA’S NOTICE OF FILING REMOVAL OF ACTION TO FEDERAL COURT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

DAVID F. MCDOWELL (CA SBN 125806) [email protected] MORRISON & FOERSTER LLP 707 Wilshire Boulevard Los Angeles, California 90017-3543 Telephone: (213) 892-5200 Facsimile: (213) 892-5454

ALEXANDRA E. LAKS (CA SBN 291861) [email protected] MORRISON & FOERSTER LLP 425 Market Street San Francisco, CA 94105-2482 Telephone: (415) 268-7000 Facsimile: (415) 268-7522


SUPERIOR COURT OF THE STATE OF CALIFORNIA

COUNTY OF SAN DIEGO


Plaintiff,

v.


Defendant.

Case No. 37-2018-00033037-CU-BT-CTL

DEFENDANT ADIDAS AMERICA, INC.’S NOTICE OF FILING NOTICE OF REMOVAL OF ACTION TO FEDERAL COURT

Judge: Hon. Randa Trapp Dept.: C-70

Exhibit 1 Page 1


Exhibit 1 Page 2


sf-3931919 3 ADIDAS AMERICA’S NOTICE OF FILING REMOVAL OF ACTION TO FEDERAL COURT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

PROOF OF SERVICE

I declare that I am employed with the law firm of Morrison & Foerster LLP, whose address is 425 Market Street, San Francisco, California 94105-2482. I am not a party to the within cause, and I am over the age of eighteen years.

I further declare that on September 7, 2018, I served a copy of:

DEFENDANT ADIDAS AMERICA, INC.’S NOTICE OF FILING NOTICE OF REMOVAL OF ACTION TO FEDERAL COURT

BY ELECTRONIC TRANSMISSION on the parties listed below through theOneLegal system.

BY U.S. MAIL [Code Civ. Proc sec. 1013(a)] by placing a true copy thereofenclosed in a sealed envelope with postage thereon fully prepaid, addressed asfollows, for collection and mailing at Morrison & Foerster LLP, 425 Market Street,San Francisco, California 94105-2482 in accordance with Morrison & Foerster LLP’sordinary business practices.

I am readily familiar with Morrison & Foerster LLP’s practice for collection andprocessing of correspondence for mailing with the United States Postal Service, andknow that in the ordinary course of Morrison & Foerster LLP’s business practice thedocument(s) described above will be deposited with the United States Postal Serviceon the same date that it (they) is (are) placed at Morrison & Foerster LLP withpostage thereon fully prepaid for collection and mailing.

Jeffrey R. Krinsk Trenton R. Kashima FINKELSTEIN & KRINSK LLP 13181 Crossroads Parkway North 550 West C Street, Suite 1760 San Diego, CA 92101 Telephone: (619) 238-1333 Facsimile: (619) 238-5425 Email: [email protected] Email: [email protected]

Attorneys for Plaintiff CHRISTIAN DUKE

I declare under penalty of perjury under the laws of the State of California that the foregoing is true and correct.

Executed at San Francisco, California, this 7th day of September, 2018.

Kristin M. Marttila (typed) (signature)

Exhibit 1 Page 3


EXHIBIT 2


EXHIBIT 2ADuke v. adidas America, Inc.,

Case No. 37-2018-00033037-CU-BT-CTLCOMPLAINT

Exhibit 2 Page 4


COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

FINKELSTEIN & KRINSK LLP Jeffrey R. Krinsk, Esq. (SBN 109234) [email protected] Trenton R. Kashima, Esq. (SBN 291405) [email protected] 550 West C Street, Ste. 1760 San Diego, California 92101 Telephone: (619) 238-1333 Facsimile: (619) 238-5425

Attorneys for Plaintiff

SUPERIOR COURT OF THE STATE OF CALIFORNIA

COUNTY OF SAN DIEGO

CHRISTIAN DUKE, on behalf of himself andall others similarly situated,

Plaintiff,

v.


Defendants.

Case No:

CLASS ACTION COMPLAINT for:

1) Negligence

2) Breach of Contract

3) Breach of Implied Contract

4) Violation of the California CustomerRecords Act, California Civil CodeSection 1798.80, et seq.

5) Unlawful and Unfair Business PracticesUnder California Business andProfessions Code Section 17200 et seq.

Exhibit 2 Page 5


- 1 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Plaintiff Christian Duke (“Plaintiff” or “Duke”), individually and on behalf of the class of

similarly situated California citizens, alleges the following against adidas America, Inc.

(“Defendant” or “Adidas”) based upon personal knowledge with respect to himself and on

information and belief derived from, among other things, investigation of counsel and review of

public documents as to all other matters.

NATURE OF THE ACTION

1. Adidas is an Oregon corporation. Adidas holds itself out as a major purveyor of

active sportswear including apparel and footwear (i.e. “Sportswear”) that is the majority of Adidas

sales within California and, particularly, Sportswear sales via adidas.com/US.

2. Adidas is licensed by the State of California and is subject to the laws and regulations

including, inter alia, regulation through the California Attorney General’s Office and the Secretary

of State.

3. In the course of its business, Adidas collects and maintains personal, private and

legally protected information about its consumers that actively purchased Adidas Sportswear on its

adidas.com website (collectively, “members”). Adidas had and undertook a non-delegable duty to

maintain members’ highly personal and private information as confidential and purports to maintain

and follow reasonable policies and procedures to protect such information from non-consensual

disclosure such as hereby allowed by Adidas.

4. On at least June 26, 2018, Defendant publicly disclosed that hackers breached the

Adidas computer system(s) and accessed the contact information, user names and encrypted

passwords potentially other protected private information (hereinafter sometimes, “personal

information”).

5. Plaintiff is a person directly and adversely affected by Defendant’s breach and brings

this class action lawsuit on behalf of himself and all other current and former Adidas consumers that

provided protected information and who are citizens of California and whose personal information

has been compromised as a result of Defendant’s failure to safeguard personal information as

promised. Plaintiff is seeking damages, restitution, and injunctive relief requiring Adidas to

implement and maintain reasonable and effective security practices and procedures.

Exhibit 2 Page 6


- 2 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

PARTIES

6. Plaintiff Duke is a citizen of California residing in San Diego County. Plaintiff has

received only elemental information about Defendant’s misconduct and received no suitable

information regarding protection against Defendant’s misconduct.

7. Defendant Adidas is a corporation duly existing under and by virtue of the laws of

Oregon while authorized to transact business and doing substantial in the State of California,

including Defendant’s conduct of business to the allegations against Defendant.

JURISDICTION AND VENUE

8. This Court has jurisdiction of this action under Article VI, section 10 of the California

Constitution and section 410.10 of the Code of Civil Procedure. Jurisdiction is also proper under the

California Business and Professions Code section 17200 et seq.

9. This Court has jurisdiction over Adidas because it is licensed in California, conducts

business in California, and is a de facto citizen of California. Defendant maintains numerous offices

in California and conducts significant business within California by California citizens.

10. Venue is proper in this Court because Plaintiff is a citizen of San Diego County, is

authorized to do business in California and regularly conducts business in San Diego County,

including not by way of limitation, business inextricable from Defendant’s conduct as described

herein.

FACTUAL ALLEGATIONS

11. Adidas recognizes that its members’ personal information is highly sensitive and that

it has a duty to safeguard and secure such information. Adidas’ privacy policy provides, in pertinent

part, the following:

Protecting your Privacy

adidas America, Inc. ("adidas" or "we", "us", or "our") is strongly committed to protecting the privacy of your personal information collected at or in connection with an adidas website. This Online Privacy Policy (the “Policy”) applies to those adidas websites that display or link to this Policy (including adidas.com/us, miadidas.com/us, and adidas.com and referred to in this Policy as the "Website"). This Policy applies to data collected by adidas through its Websites and services that display these terms. It does not apply to those adidas sites, services and products that do not display or link to this Policy or that have their own privacy policies. This Policy describes the information we collect and how we use it. By visiting our

Exhibit 2 Page 7


- 3 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Website, you are accepting the practices described in this Policy. If you do not agree to the terms of this Policy, please do not use the Website. Consent to Collection and Processing This Website may be operated, in whole or in part, from a country other than the United States. By using our Website, you consent to having your personal information transferred to and processed in a jurisdiction outside of the United States. What Information about me does adidas.com collect and store? Our privacy policy is simple: Except as disclosed below, we don't sell, trade, give away, or rent your personal information to any company outside of the adidas Group. One of the basic principles we've tried to follow in designing this Website is to limit the information we collect from and share about you. Personal Information We collect and store information that you provide to our Website or our Customer Service Department or that we receive from third parties (such as companies providing commercially available databases). For example, when you place an order, we collect and store some or all of the following information that you provide: name, billing address, shipping address, email address, telephone number, and credit card number and expiration date. If you sign up for an adidas account, which allows you to use the same sign-in details anywhere in the world, we will ask for your name, e-mail address, date of birth and password. We will also collect the following additional information, if you choose to provide it when you sign-up for an account: telephone number, gender, personal preferences, social identifier if you choose to log in to your account via social media and age. (Emphasis supplied.) We collect your e-mail addresses and zip code if you subscribe to our newsletter and we collect your mobile number if you opt in to receive text messages. You may unsubscribe at any time by following the instructions located within each newsletter or linked to each text message. We also collect and store your geolocation information. Registration may be required and personal information collected in certain areas of the Website in which you specifically and knowingly provide such information, e.g. community postings (i.e., chat or bulletin boards), suggestions, or customer service requests. When we run a contest or sweepstakes relating to our Website, it will be accompanied by a set of rules. The rules for each contest/sweepstakes will specify how the information gathered from you for entry will be used and disclosed, if it is different than as described in this Policy. Personal information will be collected only if you voluntarily submit it to our sponsors or us. Usage Information

* * * How does adidas.com use your personal information? We may use your personal information to provide the products and services that you have ordered or requested, to process and ship orders, to provide customer service, to provide other services to you, and to personalize the Website, our communications with you, and your shopping experience. For example, when you create an adidas account, you can use your account details to log in from any location and on any device. (Emphasis supplied.) The global single sign-on for your account will allow adidas systems to identify you wherever you are, so you will not need to register with us again if you sign in from a different country. Your information also may be used to

Exhibit 2 Page 8


- 4 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

contact you about sales, new products, new site features, special offers, and personalized offers based on your location, unless you have opted to not receive promotional communications. The information we collect may be combined with information obtained from companies within the adidas Group and from other companies. (Emphasis supplied.) We may also combine this information with other information we collect as you interact with our brand across apps, social media and marketing messages we send you. Aggregating data allows adidas to update and correct the information contained in our database and to provide you with product recommendations and special offers.

How does adidas.com share your personal Information?

adidas Group - Except as described in this Policy, we will not disclose your personal information outside of adidas and the adidas Group without your consent. For further information about the companies within the adidas Group, please visit http://www.adidas-group.com. When you create an adidas account, we will share some of your account details (such as your name, email address, password and date of birth) with other adidas Group entities so you can have a global single sign-on for your account that will allow adidas systems to identify you wherever you are in the world. (Emphasis supplied.) We may also share your personal information with other adidas Group entities if both entities are responsible for your personal information, or if the other entities are acting as our service providers and processing your personal information on our instructions or on our behalf. adidas Partners - Some adidas Websites allow you to choose to share your personal information with select adidas partners so that they can contact you about their products, services or offers. Other sites do not share your contact information with third parties, but give you a choice as to whether you wish to receive communications from adidas on behalf of a business partners about its specific offer (without transferring your personal information to the third party). Co-Branded Sites - Some adidas services are co-branded by adidas and another company, with the privacy policy of both adidas and the other company displayed at the website. The information you provide, such as on registration forms, is collected by both adidas and the other company. Third-party Service Providers - We may hire other companies to provide services on our behalf, such as marketing, analytics, credit card processing, shipping, stocking orders, providing customer service, and fraud protection. These service providers have access only to such personal information needed to perform their functions and are contractually obligated to maintain the confidentiality and security of your information. They are restricted from using, selling, distributing or altering this data in any way other than to provide the requested services. For example, we will share some of your account details (such as your name, email address, password and date of birth) with our cloud service providers for the purposes of identification and authentication, so you can quickly and efficiently sign-on to your adidas account from anywhere in the world. Legal and Safety Disclosures - We may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process (emphasis added); (b) protect the rights or property of adidas or our customers, including theenforcement of our agreements or policies governing your use of our Websites andservices; or (c) act on a good faith belief that such access or disclosure is necessary toprotect the personal safety of adidas employees, customers or the public. CorporateTransactions - We may disclose personal information as part of a corporatetransaction such as a merger or sale of assets.

How does adidas.com use usage information?

Exhibit 2 Page 9


- 5 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

We use Usage Information to help us determine how people use parts of the Website and who our readers are. This allows us to improve our Website and ensure that it is as appealing as we can make it for as many people as possible. We also use Usage Information to provide statistical "ratings" information in aggregated form to our partners and other third parties about how our users collectively use the Website. We may combine Usage Information about you with other information, including Personal Information, about you in order to personalize the Website and our communications with you and to provide you with information likely to be of interest to you.

What steps are taken to help secure personal information?

AN ATHLETE CAN'T PLAY WITHOUT CONFIDENCE, AND YOU SHOULDN'T ORDER FROM A COMPANY THAT DOESN'T FOLLOW SECURE DATA PRACTICES. OUR GOAL IS TO DELIVER PERFORMANCE TO YOU IN EVERY WAY. THAT INCLUDES SECURITY. PERSONAL INFORMATION COLLECTED AT OUR WEBSITE IS STORED IN SECURE OPERATING ENVIRONMENTS THAT ARE NOT AVAILABLE TO THE PUBLIC. ONLY THOSE EMPLOYEES AND SERVICE PROVIDERS WHO NEED ACCESS TO PERSONAL INFORMATION IN ORDER TO DO THEIR JOBS ARE ALLOWED ACCESS, EACH HAVING CONFIDENTIALITY OBLIGATIONS. TO PROTECT THE SECURITY OF YOUR INFORMATION DURING TRANSMISSION, WE USE SECURE SOCKETS LAYER (SSL) SOFTWARE, WHICH ENCRYPTS INFORMATION YOU INPUT. FOR EXAMPLE, WHEN USING A CREDIT CARD TO MAKE AN ON-LINE PURCHASE, YOUR PERSONAL INFORMATION IS ENCRYPTED BEFORE YOU CONDUCT YOUR TRANSACTION. MOST BROWSERS WILL GIVE A VISUAL INDICATION OF WHEN YOUR CONNECTION IS SECURE. FOR EXAMPLE, INTERNET EXPLORER WILL SHOW A PADLOCK ICON IN THE LOWER RIGHT OF THE BROWSER WINDOW. IF YOU PLACE AN ORDER THROUGH OUR WEBSITE, YOU WILL BE ASKED TO SET UP AN ACCOUNT AND PROVIDE AN E-MAIL ADDRESS AND PASSWORD. IN ORDER TO HELP PROTECT YOUR PERSONAL INFORMATION, YOU SHOULD BE CAREFUL ABOUT PROVIDING YOUR PASSWORD TO OTHERS. IF YOU WISH TO CANCEL YOUR ACCOUNT, OR IF YOU BECOME AWARE OF ANY LOSS, THEFT OR UNAUTHORIZED USE OF YOUR PASSWORD, PLEASE CONTACT CUSTOMER SERVICE. PLEASE REFER TO THE LAST SECTION OF THIS POLICY (HOW TO CONTACT US) FOR MORE INFORMATION. WHILE WE TRY OUR BEST TO SAFEGUARD YOUR PERSONAL INFORMATION ONCE WE RECEIVE IT, NO TRANSMISSION OF DATA OVER THE INTERNET OR ANY OTHER PUBLIC NETWORK CAN BE GUARANTEED TO BE 100% SECURE. (Emphasis supplied.)

12. In addition to its storing the confidential personal information of its current consumer

membership, Adidas also stores, maintains, and shares the personal information of former members

– even years after their relationship with Adidas has ended. Indeed, preliminary reports indicate that

hackers gained access to member information dating back many years.

Exhibit 2 Page 10


- 6 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

The Data Breach

13. By June 26, 2018, Adidas announced that hackers had breached its network and

obtained certain personal information of individuals that had purchased Adidas Sportswear through

the Adidas website. The information obtained by hackers included, at the least, the full names,

contact information, user names, and encrypted passwords.

14. Adidas may not have detected the unauthorized network activity until June 26, 2018

when Adidas discovered that individual/entities had or could use login credentials to access Adidas’

network.

15. Recent reports also indicate that numerous Californians were affected by the data

breach, which, according to current tallies, is significantly a larger “base” than any other U.S. state.

Adidas Shared Personal Information with Companies that Failed to Maintain Suitable Security Measures to Safeguard Members’ Personal Information

16. According to security experts, data theft of the kind experienced by Adidas “has

become a booming business.”1

17. On information or belief, Adidas entrusted its members’ personal information while

failing to encrypt such information, failing to implement “multi-factor authentication” and failing to

employ behavior monitoring technology to promptly detect unusual activity and transfer of data.

18. Encryption is a way to enhance the security of a message or file by scrambling the

contents so that it can be read only by someone who has the right encryption key to unscramble it.

Encryption is “considered the most effective way to achieve data security.” While encryption is not

necessarily a cure-all, it “could have made the personal information in this case less valuable to

hackers or harder to access in bulk.”

19. In addition, based on information and belief, Adidas did not have systems in place to

require its employees to provide multiple layers of authentication in all areas of its computer

systems.

1 Reed Abelson and Julie Creswell, Data Breach at Anthem May Forecast a Trend, N.Y. Times,

Feb. 6, 2015, https://www.nytimes.com/2015/02/07/business/data-breach-at-anthem-may-lead-to-others.html (last visited July 2, 2018).

Exhibit 2 Page 11


- 7 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

20. “Multi-factor authentication” adds an extra layer of protection by requiring two or

more of the different types of authentication before accessing secured data. For example, along with

the person’s username and password, the user may also be required to enter a temporary key or

password sent via e-mail or text message in order to gain access to the system.2

21. Adidas may also have failed to implement behavior analytics technology which

would have detected unusual transfers of large amounts of data from its computer systems. Because

of this, the hackers were perhaps able to navigate inside and transfer data from Adidas’ computer

database for a length of time until the unusual activity was finally detected. At least one expert has

opined that the failure to notice the “ex-filtration” of large amounts of data from its system over this

period of time is a “pretty shocking” situation.3

22. Although Adidas has received periodic warnings from enforcement sources and

cybersecurity experts – and observed multiple high-profile data breaches involving, for example,

Target Corp., The Home Depot, Inc., and JPMorgan Chase, among others – Adidas entrusted its

members’ personal information within a process that failed to maintain reasonable security

procedures or implement basic safeguards to protect personal information.

Effect on Victims of Adidas’ Failure to Protect Members’ Information

23. The ramifications of Adidas’ failure to protect the personal information of its

members are severe. Identity thieves can use the information taken in the breach to perpetrate a

variety of crimes that harm victims. For instance, identity thieves may commit various types of

government fraud such as immigration fraud, obtaining a driver’s license or identification card in the

victim’s name but with another’s picture, and/or using the victim’s information to obtain government

benefits.

24. Under SSA policy, individuals cannot obtain a new Social Security number if there is

evidence of ongoing problems due to misuse of the Social Security number. Even then, the SSA

recognizes that “a new number probably will not solve all your problems. This is because other

2 J.K. Wall, Anthem’s IT system had cracks before hack, Indianapolis Business Journal,

https://www.ibj.com/articles/51789-anthems-it-system-had-cracks-before-hack (last visited July 2, 2018).

3 Id.

Exhibit 2 Page 12


- 8 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

governmental agencies (such as the IRS and state motor vehicle agencies) and private businesses

(such as banks and credit reporting companies) will have records under your old number. Along

with other personal information, credit reporting companies may use the number to identify your

credit record. So using a new number will not guarantee you a fresh start.

25. Identity thieves can also use a victim’s confidential personal information to commit

any number of frauds, such as obtaining a job, procuring a house, or even giving false information to

police during an arrest. Personal information can be used to submit false insurance claims, obtain

prescription drugs or medical devices for black-market resale. As a result, Plaintiff and members of

the class now face an immediate risk of identity theft and other problems associated with the

disclosure of personal information and will need to monitor their credit for an indefinite duration.

26. The processes of discovering and dealing with the repercussions of identify theft are

time consuming and difficult. The Department of Justice’s Bureau of Justice statistics found that

“among victims who had personal information used for fraudulent purposes, 29% spent a month or

more resolving problems.”4 Likewise, credit-monitoring services are not preventative, meaning they

cannot catch identity theft until after it happens.

27. Additionally, there is commonly lag time between when harm occurs and when it is

discovered, and also between when personal information is stolen and when it is used. According to

the U.S. Government Accountability Office, which conducted a study regarding data breaches:

[L]aw enforcement officials told us that in some cases, stolen data may be held for up to a year or more before being used to commit identity theft. Further, once stolen data have been sold or posted on the Web, fraudulent use of that information may continue for years. As a result, studies that attempt to measure the harm resulting from data breaches cannot necessarily rule out all future harm.

28. There is a strong probability that Plaintiff and the Class could be at risk of fraud and

identity theft for extended periods of time.

29. Additionally, the FBI has recently been investigating “fraudulent tax returns filed in

several states through the popular software [Intuit] TurboTax, the latest instance of creative tricks

4 Erika Harrell and Lynn Langton, Victims of Identity Theft, 2012 (Bureau of Justice Statistics),

Dec. 2013 https://www.bjs.gov/index.cfm?ty=pbdetail&iid=4911 (last visited July 2, 2018).

Exhibit 2 Page 13


- 9 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

cybercriminals are using to profit from stolen data.”5 Indeed, TurboTax had to temporarily suspend

electronic filings of state tax returns “after spotting an uptick in people using stolen personal

information to file fraudulent returns and claim tax refunds.”6

30. As a result of Defendant’s negligent security practices and delay in notifying affected

customers, Plaintiff and other similarly situated former Adidas customers now face years of constant

surveillance of their financial and personal records, monitoring, and loss of rights. Plaintiff and

members of the class (defined below) are subject to an increased and concrete risk of identity theft as

a direct result of Defendant’s exposure of their confidential personal information.

CLASS ACTION ALLEGATIONS

31. Pursuant to California Code of Civil Procedure section 382 and California Rules of

Court 3.765, Plaintiff seeks certification of the following class of individuals.

All current and former consumers who made purchases on or through Adidas.com who are California citizens and whose personal and/or confidential information was compromised as a result of the data breach announced by Adidas on or about June 28, 2018. 32. Excluded from the Class is Adidas, including any entity in which Adidas has a

controlling interest, is a parent or subsidiary, or which is controlled by Adidas, as well as the

officers, directors, affiliates, legal representatives, heirs, predecessors, successors, and assigns of

Adidas. Also excluded are the judges and court personnel in this case and members of their

immediate families.

33. The members of the class are so numerous that the joinder of all members is

impractical. While the exact number of class members is unknown to Plaintiff at this time, based on

the information and belief, it is significant.

34. There are questions of law and fact common to the classes, which predominate over

any questions affecting only individual class members. These common questions of law and fact,

include without limitation:

5 Shan Li, FBI probes rash of fraudulent state tax returns filed through TurboTax, LA Times, Feb. 11, 2015 http://www.latimes.com/business/la-fi-turbotax-fbi-20150212-story.html (last visited July 2, 2018).

6 Id.

Exhibit 2 Page 14


- 10 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

(a) Whether Adidas owed a duty to Plaintiff and members of the class to adequately

protect their personal information and to provide timely and accurate notice of the

data breach to Plaintiff and members of the class;

(b) Whether Adidas knew or should have known that its computer systems and related

products were vulnerable to attack;

(c) Whether Adidas’ conduct, including its entrustment of the personal information of

Plaintiff and the class to Adidas, resulted in or was a proximate cause of the breach of

its systems, resulting in the loss of many consumers’ personal information;

(d) Whether Plaintiff and members of the class suffered injury, including ascertainable

losses, as a result of Adidas’ conduct including negligent entrustment and failure to

act;

(e) Whether Adidas’ storage, protection, and sharing protocols were reasonable under

industry standards;

(f) Whether Adidas violated California Civil Code section 1798.81.5 by failing to

implement reasonable security procedures and practices;

(g) Whether Adidas violated California Civil Code section 1798.82 by failing to

promptly notify class members that their personal information had been

compromised;

(h) Whether Plaintiff and members of the class may obtain injunctive relief against

Adidas under Civil Code section 1798.84 and under California’s Unfair Competition

Law, Cal. Bus. and Prof. Code. section 17200, et seq.;

(i) Whether Plaintiff and members of the class are entitled to recover damages and/or

statutory damages;

(j) Whether Plaintiff and members of the class are entitled to equitable relief, including

injunctive relief, restitution, disgorgement and/or other equitable relief.

35. All members of the proposed class are readily ascertainable by objective criteria.

Adidas has access to addresses and other contact information of members of the class, which can be

used for providing notice to many class members.

Exhibit 2 Page 15


- 11 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

36. Adidas’ liability can be determined by facts common to all members of the class.

37. Plaintiff’s claims are typical of those of other class members because Plaintiff’s

information, like that of other members of the class, was misused and/or disclosed by Defendant and

requires responsive efforts.

38. Plaintiff will fairly and adequately represent and protect the interests of the members

of the class. Plaintiff’s counsel is competent and experienced in litigating class actions.

39. A class action is superior to other available methods for the fair and efficient

adjudication of this controversy since joinder of all members is impracticable. Furthermore,

adjudication of this controversy through a class action will avoid the possibility of inconsistent and

potentially conflicting adjudication of the asserted claims. There will be no difficulty in the

management of this action as a class action.

40. Damages for any individual class members may be insufficient to justify the cost of

individual litigation, so that in the absence of class treatment, Adidas’ violations of law inflicting

substantial damages in the aggregate would go un-remedied without certification of the Class.

41. Class certification is appropriate because Adidas has acted or has refused to act on

grounds generally applicable to the class, so that final injunctive relief or corresponding declaratory

relief is appropriate as to the class as a whole.

FIRST CAUSE OF ACTION Negligence

(On Behalf of Plaintiff and the Class)

42. Plaintiff incorporates by reference all preceding paragraphs as if fully set forth herein.

43. In collecting the Personal Information of its current and former users/customers,

Adidas owed Plaintiff and members of the Class a duty to exercise reasonable care in safeguarding

and protecting that information. This duty included, among other things, maintaining and testing the

security systems of any entities who were granted access to the Personal Information of its members

prior to sharing such information and taking other reasonable security measures to protect and

adequately secure the personal data of Plaintiff and the Class from unauthorized access and use.

Adidas' security system and procedures for handling the Personal Information of its members were

Exhibit 2 Page 16


- 12 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

intended to affect Plaintiff and members of the Class. Adidas was aware that by taking such sensitive

Personal Information of its members, it had a responsibility to take reasonable security measures to

protect the data from being stolen and, in the event of theft, easily accessed.

44. The duty Adidas owed to Plaintiff and members of the Class to protect their Personal

Information is also underscored by the Adidas response, which recognize the importance of

maintaining the confidentiality of Personal Information and were established to protect individuals

from the improper disclosure of their Personal Information.

45. Additionally, Adidas had a duty to timely disclose to Plaintiff and members of the

Class that their personal information had been or was reasonably believed to have been

compromised. Timely disclosure is appropriate so that Plaintiff and members of the Class could,

among other things, report the theft of sensitive numbers to the Internal Revenue Service, monitor

their credit reports for identity fraud, undertake appropriate measures to avoid unauthorized charges

on their debit card or credit card accounts, and change or cancel their debit or credit card PINS

(personal identification numbers) to prevent or mitigate the risk of fraudulent cash withdrawals or

unauthorized transactions.

46. There is a close causal connection between Adidas’ failure to take reasonable security

standards to protect its current and former members' Personal Information and the injury to Plaintiff

and members of the Class. When individuals have their Personal Information stolen, they are placed

at risk for identity theft, and immediately need credit monitoring services and purchase credit reports

to determine whether identify theft has occurred.

47. Adidas is morally to blame for not protecting the data of its members by failing to

take reasonable security measures. If Adidas had taken reasonable security measures in the storage

and sharing of its members' Personal Information, data thieves would not have been able to access

the Personal Information of Plaintiff and members of the Class.

48. The policy of preventing future harm weighs in favor of finding a special relationship

between Adidas and members of the Class. Adidas’ members rely on Adidas’ written representation

to keep their Personal Information safe. Indeed, Plaintiff and members of the Class are in fact are

required to share their Personal Information with Adidas to make purchases. If companies like

Exhibit 2 Page 17


- 13 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Adidas are not held accountable for failing to take reasonable security measures to protect their

customers' Personal Information and ensure that companies with which it shares such information do

the same, then they will not take the steps that are necessary to protect against future cyber-attacks

and data breaches.

49. It was foreseeable that if Adidas did not take better and/or more reasonable measures

to ensure that the companies with which it shared its members' Personal Information did not enact

and maintain reasonable safeguards to protect such information, that the Personal Information of

Plaintiff and members of the Class would be stolen. Major companies, like Adidas, face a higher

threat of security breaches than other companies, due in part to the large amounts and type of data

they possess and the value of such information on the black market. Adidas should have known to

take precautions to secure its members' Personal Information and ensure that the companies with

which it shares such information do the same, especially in light of recent data breaches and

extensive warnings regarding cyberattacks and network vulnerability in the industry.

50. Adidas breached its duty to exercise reasonable care in protecting the Personal

Information of Plaintiff and the Class by seemingly failing to ensure that the companies with which

it shared members' Personal Information implemented and maintained adequate security measures to

safeguard such information, including encryption, implementation of multi-factor authentication, and

usage of behavior monitoring technology to detect unusual activity and transfers of data.

51. Adidas further breached its duty to immediately notify Plaintiff and members of the

Class about the data breach.

52. But for Adidas’ failure to ensure that the companies with which it shared members'

Personal Information implemented and maintained adequate security measures to safeguard such

information, including encryption, implementation of multi-factor authentication, and usage of

behavior monitoring technology to detect unusual activity and transfers of data, the Personal

Information of Plaintiff and members of the Class would not have been stolen, and they would not

be at a heightened risk of identity theft for the future.

53. Adidas’ negligence was a substantial factor in causing harm to Plaintiff and members

of the Class.

Exhibit 2 Page 18


- 14 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

54. As a direct and proximate result of Adidas’ failure to ensure that the companies with

which it shared members' Personal Information implemented and maintained adequate security

measures to safeguard such information, the Personal Information of current and former Adidas

members was accessed by unauthorized individuals who could use the information to commit

identity fraud, medical fraud, tax fraud, or debit and credit card fraud. Plaintiff and the Class face a

heightened risk of identity theft for years to come.

55. Neither Plaintiff nor other members of the Class contributed to the data breach, nor

did they contribute to Adidas’ use of insufficient security measures to safeguard members’ personal

information.

56. Plaintiff and the class seek compensatory damages and punitive damages with

interest, the costs of the suit and attorneys’ fees, other and further relief as this Court deems just and

proper.

SECOND CAUSE OF ACTION Breach of Contract

(On Behalf of Plaintiff and the Class) 57. Plaintiff incorporates by reference all preceding paragraphs as if fully set forth

herein.

58. Adidas’ privacy policies are set forth herein by at least paragraph 11.

59. Adidas’ privacy policy, along with any other documents produced by Adidas to

Plaintiff and the class relating to privacy, constitute an agreement between Adidas and its members.

60. Adidas has breached its agreement with Plaintiff and members of the Class to protect

their Personal Information by (1) failing to implement security measures designed to prevent this

attack even though the industry has been repeatedly warned about the risk of cyber-attacks; and (2)

failing to ensure that the companies with which it shared members' Personal Information

implemented and maintained adequate security measures to safeguard such information, including

encryption, implementation of multi-factor authentication, and usage of behavior monitoring

technology to detect unusual activity and transfers of data.

Exhibit 2 Page 19


- 15 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

61. The damages sustained by Plaintiff and members of the Class as described herein

were the direct and proximate result of Adidas’ breaches of its contractual obligations. Indeed,

Plaintiff and members of the class have been damaged by Adidas’ breach of its contractual

obligations because their Personal Information has been compromised and they are at and increased

risk for future identity theft and fraudulent activity on their accounts. Plaintiff and members of the

Class have been deprived of the value of their Personal Information and have lost money and

property as a result of Adidas’ unlawful and unfair conduct.

62. Plaintiff, individually and on behalf of the Class, seeks (a) damages suffered by

members of the Class, (b) equitable relief, and (c) injunctive relief requiring Adidas to implement

safeguards consistent with its contractual promises.

THIRD CAUSE OF ACTION Breach of Implied Contract

(On Behalf of Plaintiff and the Class)

63. Plaintiff incorporates by reference all preceding paragraphs as if fully set forth

herein.

64. When Plaintiff and members of the Class provided their Personal Information to

Adidas as a condition of purchasing products, Plaintiff and members of the Class entered into

implied contracts with Adidas pursuant to which Adidas agreed to safeguard and protect such

information.

65. Plaintiff and members of the Class would not have provided and entrusted their

Personal Information to Adidas in order to purchase products in the absence of the implied contract

between them and Adidas.

66. Plaintiff and members of the Class performed their obligations under the implied

contracts with Adidas.

67. Adidas has breached its agreement with Plaintiff and members of the Class to protect

their Personal Information by (1) failing to implement security measures designed to prevent this

attack even though the industry has been repeatedly warned about the risk of cyber-attacks, and (2)

failing to ensure that the companies with which it shared members' Personal Information

Exhibit 2 Page 20


- 16 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

implemented and maintained adequate security measures to safeguard such information, including

encryption, implementation of multi-factor authentication, and usage of behavior monitoring

technology to detect unusual activity and transfers of data.

68. The damages sustained by Plaintiff and members of the class as described herein

were the direct and proximate result of Adidas’ breaches of its implied contracts. Indeed, Plaintiff

and members of the Class have been damaged by Adidas’ breach of its implied contractual

obligations because their Personal Information has been compromised and they are at an increased

risk for future identity theft and fraudulent activity on their accounts. Plaintiff and members of the

Class have been deprived of the value of their Personal Information and have lost money and

property as a result of Adidas’ unlawful and unfair conduct.

69. Plaintiff, individually and on behalf of the Class, seeks (a) damages suffered by

members of the Class, (b) equitable relief, and (c) injunctive relief requiring Adidas to implement

safeguards consistent with its contractual promises.

FOURTH CAUSE OF ACTION Violation of the California Customer Records Act

California Civil Code Section 1798.80 et seq. (On Behalf of Plaintiff and the Class)


herein.

71. The California Legislature enacted Civil Code section 1798.81.5 "to ensure that

personal information about California residents is protected." The statute requires that any business

that "owns or licenses personal information about a California resident shall implement and maintain

reasonable security procedures and practices appropriate to the nature of the information, to protect

the personal information from unauthorized access, destruction, use, modification, or disclosure."

Cal. Civil Code § 1798.81.5(b).

72. Likewise, "[a] person or business that conducts business in California, and that owns

or licenses computerized data that includes personal information, shall disclose a breach of the

security of the system following discovery or notification of the breach in the security of the data to

a resident of California whose unencrypted personal information was, or is reasonably believed to

Exhibit 2 Page 21


- 17 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient

time possible and without unreasonable delay[.]" Cal. Civil Code § 17982(a).

73. “Personal information” is defined by the statute as "any information that identifies,

relates to, describes, or is capable of being associated with, a particular individual, including, but not

limited to, his or her name, signature, social security number, physical characteristics or description,

address, telephone number, passport number, driver’s license or state identification card number,

insurance policy number, education, employment, employment history, bank account number, credit

card number, debit card number, or any other financial information, medical information, or health

insurance information." Cal. Civil Code § 1798.80(e). "Personal information" under Civil Code

section 1798.81.5(d)(1)(A) also includes "an individual's first name or first initial and his or her last

name in combination with" the individual's social security number.

74. Adidas is a "business" within the meaning of Civil Code section 1798.80(a). Plaintiff

and members of the Class are "individual[s]" within the meaning of the Civil Code section

1798.80(d).

75. Adidas violated sections 1798.81.5(b) and 17982(a) of the California Customer

Records Act by (1) failing to implement security measures designed to prevent this attack even

though the industry has been repeatedly warned about the risk of cyber-attacks; (2) failing to ensure

that the companies with which it shared members' Personal Information implemented and

maintained adequate security measures to safeguard such information, including encryption,

implementation of multi-factor authentication, and usage of behavior monitoring technology to

detect unusual activity and transfers of data; and (3) failing to promptly notify all affected former

and current members that their personal information had been acquired (or was reasonably believed

to have been acquired) by unauthorized persons in the data breach.

76. In addition to the other harm set forth herein, Adidas’ failure to timely notify

members of the breach has caused damage to Plaintiff and the Class who have had to buy theft

identity protection services or take other measures to remediate the breach caused by Adidas’

negligence.

Exhibit 2 Page 22


- 18 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

77. By violating Civil Code sections 1798.81.5 and 1798.82, Adidas "may be enjoined"

under Civil Code section 1798.84(e).

78. Accordingly, Plaintiff requests that the Court enter an injunction requiring Adidas to

implement and maintain reasonable security procedures to protect employees' and members' data in

compliance with the California Customer Records Act, including, but not limited to: 1) ordering that

Adidas, consistent with industry standard practices, engage third party security auditors/penetration

testers as well as internal security personnel to conduct testing, including simulated attacks,

penetration tests, and audits on Adidas’ systems on a periodic basis; (2) ordering that Adidas engage

third party security auditors and internal personnel, consistent with industry standard practices, to

run automated security monitoring; (3) ordering that Adidas audit, test, and train its security

personnel regarding any new or modified procedures; (4) ordering that Adidas, consistent with

industry standard practices, conduct regular database scanning and securing checks; (5) ordering that

Adidas, consistent with industry standard practices, periodically conduct internal training and

education to internal security personnel how to identify and contain a breach when it occurs and

what to do in response to a breach; (6) ordering Adidas to meaningfully educate its members and

employees about the threats they face as a result of the loss of their personal information to third

parties, as well as the steps they must take to protect themselves; and (7) ordering Adidas to ensure

that the companies with which it shares members' Personal Information implement and maintain

adequate security measures to safeguard members' Personal Information, including the measures

outlined above, as well as the use of encryption to protect members' Personal Information,

implementation of multi-factor authentication to access such information, and implementation of

behavior monitoring technology to detect unusual activity and transfers of data, prior to sharing such

information.

79. Plaintiff further requests that the Court require Adidas to (1) identify and notify all

members of the Class who have not yet been informed of the data breach; and (2) to notify affected

customers of any future data breaches by email within 24 hours of Adidas’ discovery of a breach or

possible breach and by mail within 72 hours.

Exhibit 2 Page 23


- 19 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

80. As a result of Adidas’ violation of Civil Code sections 1798.81.5 and 1798.82,

Plaintiff and members of the Class have and will incur economic damages relating to time and

money spent remedying the breach, including but not limited to, expenses for bank fees associated

with the breach, any unauthorized charges made on financial accounts, lack of access to funds while

banks issue new cards, tax fraud, as well as the costs of credit monitoring and purchasing credit

reports.

81. Plaintiff, individually and on behalf of the members of the Class, seek all remedies

available under Civil Code section 1798.84, including, but not limited to: (a) damages suffered by

Plaintiff and members of the Class; and (b) equitable relief.

82. Plaintiff, individually and on behalf of the members of the Class, seek reasonable

attorneys' fees and costs under applicable law.

FIFTH CAUSE OF ACTION Unlawful and Unfair Business Practices Under California Business and Professions Code

Section 17200, et seq. (On Behalf of Plaintiff and the Class)


herein.

84. Adidas’ acts and practices, as alleged in this Complaint, constitute unlawful and

unfair business practices, in violation of the Unfair Competition Law ("UCL") and Cal. Bus. & Prof.

Code § 17200, et seq., and because Adidas’ conduct was negligent:

(a) Adidas’ practices were unlawful and in violation of California Civil Code section

1798.81.5(b) because Adidas failed to take reasonable security measures in

protecting its members' Personal Information;

(b) Adidas’ practices were unlawful and in violation of California Civil Code section

1798.82 because Adidas has unreasonably delayed informing Plaintiff and members

of the Class about the breach of security after Adidas knew the data breach

occurred.

85. The acts, omissions, and conduct of Adidas constitute a violation of the unlawful

prong of the UCL because they failed to comport with a reasonable standard of care and California

Exhibit 2 Page 24


- 20 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

public policy as reflected in statutes such as the Information Practices Act of 1977 and Cal. Civ.

Code § 1798, et seq. which seek to protect customer data and ensure that entities who solicit or are

entrusted with personal data utilize reasonable security measures.

86. In failing to protect members' Personal Information (and unduly delaying informing

them of the data breach), Adidas has engaged in unfair business practices by engaging in conduct

that undermines or violates the stated policies underlying the California Customer Records Act and

the Information Practices Act of 1977. In enacting the California Customer Records Act, the

Legislature stated that: "[i]dentity theft is costly to the marketplace and to consumers" and that

"victims of identity theft must act quickly to minimize the damage; therefore expeditious notification

of possible misuse of a person's personal information is imperative." 2002 Cal. Legis. Serv. Ch. 1054

(A.B. 700). Adidas’ conduct also undermines California public policy as reflected in other statutes

such as the Information Practices Act of 1977, Cal. Civ. Code § 1798, et seq., which seeks to protect

individuals' data and ensure that entities who solicit or are entrusted with personal data utilize

reasonable security measures.

87. As a direct and proximate result of Adidas’ unlawful and unfair business practices as

alleged herein, Plaintiff and members of the Class have suffered injury in fact. Plaintiff and members

of the Class have been injured in that their Personal Information has been compromised and they are

at an increased risk for future identity theft and fraudulent activity on their financial accounts.

Members of the Class have also lost money and property by purchasing credit-monitoring set-vices

they would not otherwise had to but for Adidas’ unlawful and unfair conduct.

88. As a direct and proximate result of Adidas' unlawful and unfair business practices as

alleged herein, Plaintiff and members of the Class face an increased risk of identity theft and medical

fraud, based on the theft and disclosure of their Personal Information.

89. Because of Adidas' unfair and unlawful business practices, Plaintiff and members of

the Class are entitled to relief, including restitution for costs incurred associated with the data breach

and disgorgement of all profits accruing to Adidas because of its unlawful and unfair business

practices, declaratory relief, and a permanent injunction enjoining Adidas from its unlawful and

unfair practices.

Exhibit 2 Page 25


- 21 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

90. The injunctive relief that Plaintiff and members of the California Class are entitled to

includes, but is not limited to: (1) ordering that Adidas, consistent with industry standard practices,

engage third party security auditors/penetration testers as well as internal security personnel to

conduct testing, including simulated attacks, penetration tests, and audits on Adidas' systems on a

periodic basis; (2) ordering that Adidas engage third party security auditors and internal personnel,

consistent with industry standard practices, to run automated security monitoring; (3) ordering that

Adidas audit, test, and train its security personnel regarding any new or modified procedures; (4)

ordering that Adidas, consistent with industry standard practices, conduct regular database scanning

and securing checks; (5) ordering that Adidas, consistent with industry standard practices,

periodically conduct internal training and education to inform internal security personnel how to

identify and contain a breach when it occurs and what to do in response to a breach; (6) ordering

Adidas to meaningfully educate its former and current members and employees about the threats

they face as a result of the loss of their personal information to third parties, as well as the steps they

must take to protect themselves; and (7) ordering Adidas to ensure that the companies with which it

shares members' Personal Information implement and maintain adequate security measures to

safeguard members’ personal information, including the measures outlined above, as well as the use

of encryption to protect members' Personal Information, implementation of multi-factor

authentication to access such information, and implementation of behavior monitoring technology to

detect unusual activity and transfers of data, prior to sharing such information.

91. Plaintiff, individually and on behalf of members of the Class, also seeks reasonable

attorneys' fees and costs under applicable law.

PRAYER FOR RELIEF

WHEREFORE, Plaintiff, on behalf of himself and the Class set forth above, respectfully

requests the following relief:

a. That the Court certify this case as a class action, appoint Plaintiff to be Class

representative, and the undersigned counsel to be Class counsel;

b. That the Court award Plaintiff and members of the Class appropriate relief, including

actual and statutory damages, restitution and disgorgement;

Exhibit 2 Page 26


- 22 -COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

c. That the Court award Plaintiff and members of the Class equitable, injunctive and

declaratory relief as maybe appropriate under applicable law set forth above;

d. That the Court award Plaintiff and members of the Class actual damages,

compensatory damages, statutory damages, and statutory penalties, to the full extent permitted by

law, in an amount to be determined;

e. That the Court award Plaintiff and members of the Class pre-judgment and post-

judgment interest;

f. That the Court award Plaintiff and members of the Class reasonable attorneys' fees

and costs as allowable by law; and

g. That the Court award Plaintiff and members of the Class such other, favorable relief

as allowable under law or at equity.

JURY DEMAND

Plaintiff demands a trial by jury on all issues so triable.

Respectfully submitted, FINKELSTEIN & KRINSK LLP Dated: July 3, 2018 By: s/ Jeffrey R. Krinsk

Jeffrey R. Krinsk, Esq. (SBN 109234) [email protected] Trenton R. Kashima, Esq. (SBN 291405) [email protected] 550 West C Street, Ste. 1760 San Diego, California 92101 Telephone: (619) 238-1333 Facsimile: (619) 238-5425 Attorneys for Plaintiff

Exhibit 2 Page 27


EXHIBIT 2BDuke v. adidas America, Inc.,

Case No. 37-2018-00033037-CU-BT-CTLSUMMONS

Exhibit 2 Page 28


Exhibit 2 Page 29


EXHIBIT 2CDuke v. adidas America, Inc.,

Case No. 37-2018-00033037-CU-BT-CTLCIVIL CASE COVER SHEET

Exhibit 2 Page 30


CM-010ATTORNEY OR PARTY WITHOUT ATTORNEY (Name, State Bar number, and address): FOR COURT USE ONLY

-Finkelstein & Krinsk LLPJeffrey R. Krinsk (109234)/Trenton R. Kashima (291405)550 West C Street, Suite l 760, San Diego, CA 92101San Diego, CA 9210 I

ELECTROHICALL Y FILED TELEPHONE NO. �619) 238-1333 FAXNO. (619) 238-5425ATTORNEY FOR (Name): laintiff Christian Duke Superior Court of California,

County of San Diego SUPERIOR COURT OF CALIFORNIA, COUNTY OF SAN DIEGO

07 /0312018 at 03: 12 :07 PM STREET ADDRESS: 330 W. Broadway MAILING ADDRESS: 330 W. Broadway Clerk of the Superior Court

CITY AND ZIP CODE: San Diefto 92101 By Jacqueline J. Walters, Deputy Clerk BRANCH NAME: Hall of ustice

CASE NAME: Christian Duke v. adidas America, Inc.

CIVIL CASE COVER SHEET CASE NUMBER:

Complex Case Designation

0 Unlimited D Limited D Counter D 37-2018-00033037 -CU-BT-CTLJoinder

1.

2.

(Amount (Amount demanded demanded is Filed with first appearance by defendant JUDGE: Judge Randa Trapp exceeds $25,000) $25,000 or less) (Cal. Rules of Court, rule 3.402) DEPT:

Items 1-6 below must be completed (see mstrucflons on page 2).

Check one box below for the case type that best describes this case: Auto Tort Contract Provisionally Complex Civil Litigation

D Auto(22) D Breach of contracUwarranty (06) (Cal. Rules of Court, rules 3.400-3.403)

D Uninsured motorist (46) D Rule 3.740 collections (09) D Antitrust/Trade regulation (03) Other PI/PD/WD (Personal Injury/Property D Other collections (09) D Construction defect (10) Damage/Wrongful Death) Tort D Insurance coverage (18) D Mass tort (40) D Asbestos (04) D Other contract (37) D Securities litigation (28) D Product liability (24) Real Property D Environmental/Toxic tort (30) D Medical malpractice (45) D Eminent domain/Inverse D Insurance coverage claims arising from the D Other Pl/ PD/WD (23) condemnation (14) above listed provisionally complex case Non-PI/PD/WD (Other) Tort D Wrongful eviction (33) types (41)

0 Business tort/unfair business practice (07) D Other real property (26) Enforcement of Judgment

D Civil rights (08) Unlawful Detainer D Enforcement of judgment (20) D Defamation (13) D Commercial (31) Miscellaneous Civil Complaint

D Fraud (16) D Residential (32) D RIC0(27) D Intellectual property (19) D Drugs (38) D Other complaint (not specified above) (42) D Professional negligence (25) Judicial Review Miscellaneous Civil Petition D Other non-Pl/PD/WO tort (35) D Asset forfeiture (05) D Partnership and corporate governance (21) Employment D Petition re: arbitration award (11) D Other petition (not specified above) (43) D Wrongful termination (36) D Writ of mandate (02) D Other employment (15) D Other judicial review (39) This case W is LJ is not complex under rule 3.400 of the California Rules of Court. If the case is complex, mark the factors requiring exceptional judicial management: a. D Large number of separately represented parties d. D Large number of witnesses b. 0 Extensive motion practice raising difficult or novel e. D Coordination with related actions pending in one or more courts

issues that will be time-consuming to resolve in other counties, states, or countries, or in a federal court c. 0 Substantial amount of documentary evidence f. D Substantial postjudgment judicial supervision

3. Remedies sought (check all that apply): a.0 _monetary b. 0 nonmonetary; d�cla

�

ato or_injunctive relief c. 0. pu. nitive

4. Number of causes of action (specify): 5:Neghgence, Breach of Contract, v1701. r. �jl' ode/Bu

0. & rot Code

5. This case 0 is D is not a class action suit./ /(½� //, i,, 7

6. If there are any known related cases, file and serve a notice of related case. (Yyu mo/:'. 'Je,forry/J tpi ,) ,// // Date: July3,2018 ·

r ,/ '//// // Jeffrey R. Krinsk // 1/ t/ (/

(TYPE OR PRINT NAME)

NOTICE

• Plaintiff must file this cover sheet with the first paper filed in the action or proceeding (except small claims cases or cases filedunder the Probate Code, Family Code, or Welfare and Institutions Code). (Cal. Rules of Court, rule 3.220.) Failure to file may resultin sanctions.

• File this cover sheet in addition to any cover sheet required by local court rule.• If this case is complex under rule 3.400 et seq. of the California Rules of Court, you must serve a copy of this cover sheet on all

other parties to the action or proceeding.• Unless this is a collections case under rule 3.740 or a complex case, this cover sheet will be used for statistical purposes onlv.

15ae1of2

Fonn Adopted for Mandator y Use Judicial Council of California CM-010 [Rev. July 1, 2007]

CIVIL CASE COVER SHEET Cal. Rules of Court, rules 2.30, 3.220. 3.400-3.403, 3.740;

Cal. Standards of Judicial Administration. std. 3.1 o www.courtinfo.ca.gov

Exhibit 2 Page 31


INSTRUCTIONS ON HOW TO COMPLETE THE COVER SHEET CM-OIO

To Plaintiffs and Others Filing First Papers. lf you are filing a first paper (for example, a complaint) in a civil case, you mustcomplete and file, along with your first paper, the Civil Case Cover Sheet contained on page 1. This information will be used io compilestatistics about the types and numbers of cases filed. You must complete items '1 through 6 on the sheet. ln item 1, you must checkone box for the case type that best describes the case. lf the case fits both a general and a more specific type of case listed in item 1,check the more specific one. lf the case has multiple causes of action, check the box that best indicates the primary cause of action.To assist you in completing the sheet, examples of the cases that belong under each case type in item 1 are provided below. A coversheet must be filed only with your initial paper. Failure to file a cover sheet with the first paper filed in a civil case may subject a party,its counsel, or both to sanctions under rules 2.30 and 3.220 of the California Rules of Court.To Parties in Rule 3.740 Collections Gases. A "collections case" under rule 3.740 is defined as an action for recovery of moneyowed in a sum stated to be certain that is not more than $25,000, exclusive of interest and attorney's fees, arising from a transaction inwhich propefi, services, or money was acquired on credit. A collections case does not include an action seeking the following: (1) tortdamages, (2) punitive damages, (3) recovery of real property, (4) recovery of personal property, or (5) a prejudgment writ ofattachment. The identification of a case as a rule 3.740 collections case on this form means that it will be exempt from the generaltime-for-service requirements and case management rules, unless a defendant files a responsive pleading. A rule 3.740 collectionscase will be subject to the requirements for service and obtaining a judgment in rule 3.740.To Parties in Complex Cases. ln complex cases only, parties must also use the CrVll Case Cover Sheef to designate whether thecase is complex. lf a plaintiff believes the case is complex under rule 3.400 of the California Rules of Court, this must be inclicated bycompleting the appropriate boxes in items 1 and 2. lf a plaintiff designates a case as complex, the cover sheet must be served with thilcomplaint on all parties to the action. A defendant may file and serve no later than the time of its first appearance a joinrJer in theplaintiffs designation, a counter-designation that the case is not complex, or, if the plaintiff has made no designation, a designation thatthe case is complex' cAsE wpEs AND EXAMpLESAuto Tort Contract Provisionally Complex Givil Litigation (Cal.

Auto (22)-Personal lnjury/Property Breach of ContractMarranty (06) Rules of Gourt Rules 3.40(F3.403)DamageMrongful Death Breach of Rentat/Lease AntitrusUTrade Regulation (03)

Uninsured Motorist (46) (if the Contract (not unlawful detainer Construction Defect (10)case involves an uninsured orwrcngful eviction) Claims lnvolving Mass Tort (40)motoist claim subject to Contract/Warranty Breach-Seller Securities Litigation (28)arbitration, check this item Plainlifl (not fraud or negligence) Environmental/Toxic Tort (30)instead of Auto) Negligent Breach of Contracu lnsurance Coverage Claims

Other PUPD/WD (Personal lnjury/ ^ . Warranty _ - (arising from prcvisionally complex

Property Damag!/Wrongtut Dedthl Other Breach of ContractM/arranty case type listed above) (41)Tort Collections (e.9., money owed, open Enforcement of Judgment

Asbestos (04) book accounts) (09) Enforcement ofJudgment (20)

Asbestos properg Damage Collection Case-Seller Plaintiff Abstract of Judgment (Out ofAsbestos eerbonil lnluryl- Other Promissory Note/Collections County)

Wrongful Death Case Confession of Judgment (non-product Liabili{r (nof asbesfos or lnsurance Coverage (not ptovisionally - domestic retations)

toxic/envir6imental) (24) complex) (18) Sister State JudgmentMedical Malpractice (45) ' Auto Subrogation Administrative Agency Award

Medical Malpraciice- Other Coverage @ot unpaid taxes)Physicians & Surgeons Other Contract (37) Petition/Certification of Entry of

Other piofessional Health Care Contractual Fraud Judgment on Unpaid TaxesMalpractice Other Contract Dispute Othel Enforcement of Judgment

other Pt/PD/il/D (23) nea erolirty- case

Premises Liaiility 1e.g., stlp Eminent Domain/lnverse Miscellaneols Givil Complaintand fall) Condemnation (14) RICO (27)

lntentional dodily lnjury/PDMD Wrongful Eviction (33) Other.Complainl (not specified

(9.9., asgaitt, varioatism; other Reat property (e.g., quiet tile) (26) above) (42\

lnteniioiat tnfliction of writ of pos'sesiion of ieat property Declaratory Relief onlyEmotional Distress Mortgage Foreclosure

'sr I rvvvr(' lnjunctive Relief only (non-

Negligent lnfliction of euiet Tile hanssment)-

Emotional Distress Other Real property (not eminent Mechanics Lien

Other PI/PDMD domain, tandlod/tenant, or Other Commercial Complaint

Non-pUpDruVD (Other) Tort forecloiure) Case (non-torunon-complex)

Business Toruunfair Business Unlawful Detainer other Civil complaint

Practice (07) . . commercial (31) rr,--- (non-toft/non-complex)

civir Rishts ie.s., oiscrimination, Residenriat (32) .."""jii[?:ffi:l"J'J;iil"1"false arrest) (not civil Drugs (38) (if the case invotves iilegat covernance (21)harassment) (08\

5r r;h^r\ -drugs,

check this item; otherulse,.. .. Other petition (not specifiedDefamation (e.9., slander, libel) ryOoft as Commercial or Residential) above) (43)(13) Judicial Review

Fraud (1'6) Asser Forfeirure (05) fiixil-fffi"ri:::l*lntellectual Property (19) Petition Re: Arbitration Award (1 1) Etder/Dependent AdultProfessional Negligence (25) Writ.of Mandate.(02). AbuseLegal Malpractice Writ-Administrative Mandamusotier proiessional Malpractice wril-Mandamus on Limited court Election contest

(not medicat or legat) case Matter Petition lor Name change

other Non-pr/pDMD Tort (35) writ-other Limited court case t"t'8:,t;t Relief From Late

Employment Review other civil petitionwronglul Termination (36) other Judiciat Review (39)Other Employment (15) Review of Heatin dmcer OrOer

Notice of Appeal-LaborCommissioner

CM410 [Rev. July 1,20onCIVIL CASE COVER SHEET Page

Exhibit 2 Page 32


EXHIBIT 2DDuke v. adidas America, Inc.,

Case No. 37-2018-00033037-CU-BT-CTLPROOF OF SERVICE OF

SUMMONS & COMPLAINT

Exhibit 2 Page 33


AlTORNEYOR PARTY WITHOUTATTORNEY(Name, Stale Sar number, and address/

Jeffrey R. Krinsk, Esq. i SBN: 109234FINKELSTEIN& KRINSK550 West C Street Suite 1760 San Diego, CA 92101

TELEPHONE Nod (alai 2301333 I FAX No (BIB)23!LBS23 IEJJAIL ADDRESS (Op!dna/.ATTORNEYFOR (Name/f l

FOR COURT'SE ONLY

POS-01/i

SAN DIEGO/SAN DIEGO SUPERIOR COURT

STREET AoDREss: 330 W. BROADWAY

CITYANDZIPCODE SAN DIEGO, CA 92101-3409BRANCH NAME: CENTRAL DIVISION

PLAINTIFF/PETITIONER:Chrstian Duke, etal.DEFENDANT/RESPONDENT: adidas America, Inc. CASE NUMBER:

37-2015-00033037-CU-BT-CTL

PROOF OF SERVICE OF SUMMONSReL No. or File Nod

Duke v Adidas

(Se pere/e pmo/ of service is required for each per/y served)

1. At the time of service I was at least 18 years of age and not a party to this action.2. I served copies of:

a.2 summonsb.2 complaintc R Alternative Dispute Resolution (ADR) packaged. R Civil Case Cover Sheete. Cl cross-comptaintf R other (specify documen(s): Notice of Case Assignment and Case Management Conference on Mandatory eFile

Case3. a. Party served (spec//y name ofparty as shown on documents served):


b 2 Person (other than the party in item 3a) served on behalf of an entity or as an authorized agent (and not a person underitem 5b on whom substituted service was made) (spec//y name snd relationship Io the pariy named in item 3e):

DWT California,lncm as Agent for Service - by leaving with Travis Parker, Authorized to Accept4. Address where the party was served: 865 S Figueroa St Ste 2400

Los Angeles, CA 90017-2566

5. I se~iv d the parly(check pmperbox)a. M by personal service. I personally delivered the documents listed in item 2 to the party or person authorized to

receive service of process for the party (1) on(da/e): 8/8/2018 (2) at(//me)/1:20 PM

b by substituted service. On (ds/e)( at (//me): I left the documents listed in item 2 with orin the presence of (name snd /i//e or re/s/ionsh(p /o person /ndics/ed in item 3b)/

(1) Q (business) a person at least 18 years of age apparently in charge at the office or usual place of business of theperson to be served. I informed him of her of the general nature of the papers.

(2) Q (home) a competent member of the household (at least 18 years of age) at the dwelling house or usual place ofabode of the party. I informed him or her of the general nature of the papers.

(3) 0 (physical address unknown) a person at least 18 years of age apparently in charge at the usual mailingaddress of the person to be served, other than a United States Postal Service post office box. I informed him ofher of the general nature of the papers.

(4) 0 I thereaffer mailed (by first-class, postage prepaid) copies of the documents to the person to be served at theplace where the copies were left (Code Civ. Proc., 0415.20). I mailed the documents on(dele): from (ci/y)l or p a declaration of mailing is attached.

(5) I—I I attach a declaration of diligence stating actions taken first to attempt personal service.

Form Approved for Mandotorr UseJudidsl Coundl of CsafomlsPOSDI 0 IRev Januair I, 200rl

PROOF OF SERVICE OF SUMMONS

Psoe I of 2Code of Ceil Prosadum, 5 417.10

PD801 0-1/5 D151 25

Exhibit 2 Page 34


PETITIONER: Chreiian Duke, eiai.

RESPONDENT: asieae America, inc.

CASE NUMBER:

37-2013-00033037-CU-BT-CTL

c, 0 by mail and acknowledgment of receipt of service. I mailed the documents listed in item 2 to the party, to the addressshown in item 4, by first-dass mail, postage prepaid,

(1) on (dale): (2) from (city):

(3) with two copies of the Notice andAcknowledgment ofRecelpland a postagepaid return envelope addressed to me.(Attach completed Notice and Acknowledgement of Receipt.) (Code Civ. Proc., 5 415.30.)

(4) t-j to an address outside California with return receipt requested. (Code Civ. Proc., 5 415.40.)

d, 0 by other means (specify means of service end aulhonzlng code section):

Additional page describing service is attached.6. The "Notice to the Person Sewed" (on the summons) was completed as follows:

a. 0 as an individual defendant.b. 0 as the person sued under the fictitious name of (specify):c. D as occupant.d j—j On behalf of (specify): adidas America, inc.

under the following Code of Civil Procedure section:

416.10 (corporation) 415.95 (business organization, form unknown)416.60 (minor)'1 6.70 (ward or conservatee)416.90 (authorized person)

D 41546 (occupant)other.

0 416.20 (defunct corporation)

0 416.30 (joint stock companylassociation)

0 416.40 (association or partnership)0 416.50 (public entity)

7. Person who served papersa. Name: Jose Nlartinez - Nationwide Legal, LLC REG: 12-23464Sb. Address: 110 West C. St, Suite 1211 San Diego, CA 92101c. Telephone number: (619) 232-7500d. The fee for service was: $ 280.00e. I am:

(1) Igt not a registered California process server.(2) g

exempt from registration under Business and Professions Code section 22350(b).(3) registered California process server:

(i) Lj owner p employee CI independent contractor.

(ii) Registration Noz 2013119507(iii) County: Los Angeles

6. El I declare under penalty of penury under the laws of the State of California that the foregoing is true and correct.

or',0 I am a California sheriff or marshal and I certify that the foregoing is true and correct.

Date: 8/8/2018Nationwide Legal, LLC110 West C. St, Suite 1211San Diego, CA 92101(619) 232-7500www.nationwideaaap.corn

Jose llllartinez(NAME OF PERSON WHO SERVED PAPERSISHERIFF OR MARSHAL)

POSAH0 (Rev Jeeenr 1, 200FIPROOF OF SERVICE OF Sdiitiy/ONS Peee2ef2

POS-010/SD15126

Exhibit 2 Page 35


ATTORNEY OR PARTY WITHOUTATTORNEY(Nemr, Ernie Emnnmlmr, end eddmeei

Jeffrey R. Krlnsk, Esq. SBN: 109234FINKELSTEIN8 KRINSK850 West C Street Suite 1780 Sen Diego, CA 02101

TELEPHONE Ncd i819I 238-1333Em(AIL AOO RESS (OPeermer

ATTORNEY FOR (elemelr

SAN DIEGO/SAN DIEGO SUPERIOR COURT

srREET AUUREEE: 330 W. BROADWAY

CITYAN0 ZIP COOE SAN DIEGO, CA 821013409

FAx No..i819) 238-8425

FOR COURT UEE ONE Y

REFERENCE NUMEER:

Duke v Ad(des

PLAINTIFF: Chrstlsn Duke, Etel.

DEFENDANT: Edldss America, Inc.

DECLARATIONOF DILIGENCECASE NUMBER:

37-201 8-00033037-CU-BTWTL

I received the within assignment for filing and/or sewice on July 05, 2018 and that after due and diligent effort I havenot been able to serve said person.l attempted service on this servee on the following dates and times:

Servee: adldas America, Inc.

Documer(ts: Summons; Complaint; Alternative Dispute (ADR) package; Civil Case Cover Sheet; Notice of CaseAssignment and Case Management Conference on Mandatory eFile Case;

Address: 865 S Figueroa St Ste 2400Los Angeles, CA 900172566

As enumerated beloup.

7/6/2018 - 1:30 PM 865 S Figueroa St Ste 2400Business Los Angeles, CA 900172566Sewer amved at the location snd security hed to call up to grant access. At 1:35PM, they called back and said the people thatwould be authorized to accept anything are not in and to try another time. Building security explained to the server that theyare extremely paranoid most of the time, and tum people away.

7/9/2018 -1:00 PM 865 S Figueroa St Ste 2400Business Los Angeles, CA 900172586Receptionist at lobby couldn't allow server access upstairs after being denied by the receptionist

7/11/2018 —2:12 PM 865 S Figueroa St Ste 2400Business Los Angeles, CA 900172586Per receptionist at lobby, she won't allow server up since "the authorized people are not in the office".

County: Los AngelesRegistration Nori 2013119507Nationwide Legal, LLC110 West C. St, Suite 1211San Diego, CA 92101

I declare under penalty of perjury under the laws of the Stateof California that I tl1 f 18

th'ctionand thatdeclaration was

I/DECLARATIONOF DILIGENIIN:

r

Jose Martinez

Ordelel SD161 28/DIIFormat mdl

Exhibit 2 Page 36


EXHIBIT 3


JS 44 (Rev. 06/17) CIVIL COVER SHEETThe JS 44 civil cover sheet and the information contained herein neither replace nor supplement the filing and service of pleadings or other papers as required by law, except asprovided by local rules of court. This form, approved by the Judicial Conference of the United States in September 1974, is required for the use of the Clerk of Court for thepurpose of initiating the civil docket sheet. (SEE INSTRUCTIONS ON NEXT PAGE OF THIS FORM.)

I. (a) PLAINTIFFS DEFENDANTS

(b) County of Residence of First Listed Plaintiff County of Residence of First Listed Defendant(EXCEPT IN U.S. PLAINTIFF CASES) (IN U.S. PLAINTIFF CASES ONLY)

NOTE: IN LAND CONDEMNATION CASES, USE THE LOCATION OF THE TRACT OF LAND INVOLVED.

(c) Attorneys (Firm Name, Address, and Telephone Number) Attorneys (If Known)

II. BASIS OF JURISDICTION (Place an “X” in One Box Only) III. CITIZENSHIP OF PRINCIPAL PARTIES (Place an “X” in One Box for Plaintiff(For Diversity Cases Only) and One Box for Defendant)

1 U.S. Government 3 Federal Question PTF DEF PTF DEFPlaintiff (U.S. Government Not a Party) Citizen of This State 1 1 Incorporated or Principal Place 4 4

of Business In This State

2 U.S. Government 4 Diversity Citizen of Another State 2 2 Incorporated and Principal Place 5 5Defendant (Indicate Citizenship of Parties in Item III) of Business In Another State

Citizen or Subject of a 3 3 Foreign Nation 6 6 Foreign Country

IV. NATURE OF SUIT (Place an “X” in One Box Only) Click here for: Nature of Suit Code Descriptions.CONTRACT TORTS FORFEITURE/PENALTY BANKRUPTCY OTHER STATUTES

110 Insurance PERSONAL INJURY PERSONAL INJURY 625 Drug Related Seizure 422 Appeal 28 USC 158 375 False Claims Act120 Marine 310 Airplane 365 Personal Injury - of Property 21 USC 881 423 Withdrawal 376 Qui Tam (31 USC 130 Miller Act 315 Airplane Product Product Liability 690 Other 28 USC 157 3729(a))140 Negotiable Instrument Liability 367 Health Care/ 400 State Reapportionment150 Recovery of Overpayment 320 Assault, Libel & Pharmaceutical PROPERTY RIGHTS 410 Antitrust

& Enforcement of Judgment Slander Personal Injury 820 Copyrights 430 Banks and Banking151 Medicare Act 330 Federal Employers’ Product Liability 830 Patent 450 Commerce152 Recovery of Defaulted Liability 368 Asbestos Personal 835 Patent - Abbreviated 460 Deportation

Student Loans 340 Marine Injury Product New Drug Application 470 Racketeer Influenced and (Excludes Veterans) 345 Marine Product Liability 840 Trademark Corrupt Organizations

153 Recovery of Overpayment Liability PERSONAL PROPERTY LABOR SOCIAL SECURITY 480 Consumer Credit of Veteran’s Benefits 350 Motor Vehicle 370 Other Fraud 710 Fair Labor Standards 861 HIA (1395ff) 490 Cable/Sat TV

160 Stockholders’ Suits 355 Motor Vehicle 371 Truth in Lending Act 862 Black Lung (923) 850 Securities/Commodities/190 Other Contract Product Liability 380 Other Personal 720 Labor/Management 863 DIWC/DIWW (405(g)) Exchange195 Contract Product Liability 360 Other Personal Property Damage Relations 864 SSID Title XVI 890 Other Statutory Actions196 Franchise Injury 385 Property Damage 740 Railway Labor Act 865 RSI (405(g)) 891 Agricultural Acts

362 Personal Injury - Product Liability 751 Family and Medical 893 Environmental Matters Medical Malpractice Leave Act 895 Freedom of Information

REAL PROPERTY CIVIL RIGHTS PRISONER PETITIONS 790 Other Labor Litigation FEDERAL TAX SUITS Act210 Land Condemnation 440 Other Civil Rights Habeas Corpus: 791 Employee Retirement 870 Taxes (U.S. Plaintiff 896 Arbitration220 Foreclosure 441 Voting 463 Alien Detainee Income Security Act or Defendant) 899 Administrative Procedure230 Rent Lease & Ejectment 442 Employment 510 Motions to Vacate 871 IRS—Third Party Act/Review or Appeal of240 Torts to Land 443 Housing/ Sentence 26 USC 7609 Agency Decision245 Tort Product Liability Accommodations 530 General 950 Constitutionality of290 All Other Real Property 445 Amer. w/Disabilities - 535 Death Penalty IMMIGRATION State Statutes

Employment Other: 462 Naturalization Application446 Amer. w/Disabilities - 540 Mandamus & Other 465 Other Immigration

Other 550 Civil Rights Actions448 Education 555 Prison Condition

560 Civil Detainee - Conditions of Confinement

V. ORIGIN (Place an “X” in One Box Only)

1 OriginalProceeding

2 Removed fromState Court

3 Remanded fromAppellate Court

4 Reinstated orReopened

5 Transferred fromAnother District(specify)

6 MultidistrictLitigation -Transfer

8 Multidistrict Litigation - Direct File

VI. CAUSE OF ACTION

Cite the U.S. Civil Statute under which you are filing (Do not cite jurisdictional statutes unless diversity):

Brief description of cause:

VII. REQUESTED INCOMPLAINT:

CHECK IF THIS IS A CLASS ACTIONUNDER RULE 23, F.R.Cv.P.

DEMAND $ CHECK YES only if demanded in complaint:

JURY DEMAND: Yes No

VIII. RELATED CASE(S)IF ANY (See instructions):

JUDGE DOCKET NUMBER

DATE SIGNATURE OF ATTORNEY OF RECORD

FOR OFFICE USE ONLY

RECEIPT # AMOUNT APPLYING IFP JUDGE MAG. JUDGE

Christian Duke

San Diego County

Jeffrey R. Krinsk (109234) / Trenton R. Kashima (291405)Finkelstein & Krinsk LLP, 550 West C St., Suite 1760, San Diego, CA92101; Tel: (619) 238-1333


David F. McDowell (125806) / Alexandra E. Laks (291861)Morrison & Foerster LLP, 707 Wilshire Blvd., Suite 6000, Los Angeles,CA 90017; Tel: (213) 892-5200

28 U.S.C. § 1332

Purported class action arising out of alleged data security incident

09/07/2018 s/David F. McDowell

Exhibit 3 Page 37


'18CV2081 NLSLAB


DECL. OF ALEXANDRA E. LAKS IN SUPPORT OF REMOVAL OF ACTION TO FEDERAL COURT CASE NO. sf-3932100

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

DAVID F. MCDOWELL (CA SBN 125806) [email protected] MORRISON & FOERSTER LLP 707 Wilshire Boulevard Los Angeles, California 90017-3543 Telephone: 213.892-5200 Facsimile: 213.892-5454

ALEXANDRA E. LAKS (CA SBN 291861) [email protected] MORRISON & FOERSTER LLP 425 Market Street San Francisco, CA 94105-2482 Telephone: 415.268-7000 Facsimile: 415.268-7522


UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF CALIFORNIA


Plaintiff,

v.


Defendant.

Case No. _______________________

DECLARATION OF ALEXANDRA E. LAKS IN SUPPORT OF ADIDAS AMERICA, INC.’S NOTICE OF REMOVAL OF ACTION TO FEDERAL COURT

Complaint Filed: July 3, 2018


DECL. OF ALEXANDRA E. LAKS IN SUPPORT OF REMOVAL OF ACTION TO FEDERAL COURT CASE NO. 1sf-3932100

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

I, Alexandra E. Laks, declare:

1. I am a member of the California State Bar and an Associate in the law

firm of Morrison & Foerster, LLP, attorneys for Defendant adidas America, Inc.,

(“Adidas”). The facts contained in this Declaration are personally known to me in

that capacity. I make this declaration in support of Adidas’ Notice of Removal of

Action to Federal Court.

2. Attached as Exhibit A to this declaration is a true and correct copy of

website comparing six identity theft protection plans, including the cost of such

plans. I accessed this website on September 6, 2018 at

https://www.nextadvisor.com/identity_theft_protection_services/compare.php.

3. The cost of the identity theft protection plans range from $27.42 per

month to $14.99 per month. The average cost is $17.27 per month.

I declare under penalty of perjury under the laws of the State of California

that the foregoing is true and correct.

Executed on this 6th day of September, 2018, in San Francisco, California.

/s/ Alexandra E. Laks Alexandra E. Laks


EXHIBITS TO DECLARATION OF ALEXANDRA E. LAKS

Ex. Description Page

A True and correct copy of website comparing six identity theft protection plans, including the cost of such plans. Accessed on September 6, 2018 at https://www.nextadvisor.com/identity_theft_protection_services/compare.php.

1


EXHIBIT A


�� !��"

��# $��!��%�� !��"��&��&#��& �� "#%�!#�# �� ''�� $()*+,-�(.)+/��()*+,-�012,-1),23��()*+,-�4*5.,)� 627,2*�8-.95/��:*)/12.7�;1.2/��8.<,23/�=>>1?2-/� @,)-?.7�:A12*��@1B:� ��#C'%�� $D��D%�� D��E��F� ��G��

�B+*2-,-H�IA*J-�:)1-*>-,12�4*<,*K/�L�:),>*/�� % � ��F��F��"��M!�!N��"��%��O�"�''��" �%��%�!�PC ��Q��F��%��C'�� R��CF��#��C��!��C�%� ��C �%Q�C��#��F��C� '��"��N� �F��C#��C��""��#�� !��%''�#��%�'��"��F��"%��%�� "� ��"#��"� ��Q�� !�SC��#T�%�� "Q��"C'��#'��# ��"��FN� C��% ��#�� N�#CQ'�� N��%�� %�� %'� �C��C"Q�!��"�%' ��'C�� %��#��C��"#C��%��%�� C�� !�U%�"��VC �� %Q�C��%�� "�F��Q�Q ��CW�G� ��C��#��Q'�F!

�

��X� �'� C� �Y�� '�� Z�''�� [!�\��''�� ]_abcde�] aba ac�fagahijdD�kX��D �X� �k��S� l�Z�� Dk �kDU�SlSYm �E ll��M��k�� S�� D�"#%��'�F��%"��%��F �� Z�%C��E��F �X�� C�%��YC%�%�� #�� X'�� D�"#C��C�� "�l��n1�I1�8,-*4*.+�4*<,*K Z��O�T�%��%'�o�pO�� C��q%''�#'%� rsp��!��"��C%'s�p��!��"��C#'s��p�[!��"��%"�'� E�� OTQC�%C��#�� N��%�� N�#CQ'�� N��NQ%�t�%��C�� N�%##'��%�� N�� C�� p�N��N�� C�%�� O�QC�%C�� %��%#CQ'��#��%��VC%�� u�� '%�"�� C�� C��s%��Tt�'�FF��F ��%�s��XG%C'�� %� E� ��"#'��#�� s�OTQC�%C��#��"��Fs��#�� C#�%� ��VC%��spO�� C��o��O�T�%��%'n1�I1�8,-*4*.+�4*<,*K ��"�� op��!��"��q��%��C%'#�#%�r��O�T�%��%'�o�p��!��"�q��"��'��#'%�r E�� OTQC�%C��#�� N��%##'��%�� N��N��R '�� N�#% #��N��T��'�%� N�%�� %�FN��%��%��Q%�t�%��C��%��N ��F� ��N��C�� p�N��N�� C�%�� k�#��%�� %�'�s�OTQC�%C��#�� o� �� VC%��'� �� D�"#�� %��"��F�q��"�C"""Q� ��#r�%��C��VC�k�#��%�D��l��t��%�C��"Q��"#��#��F�%��%��% �T��TC ��Q ��n1�I1�8,-*4*.+�4*<,*K p�[!v[�"�w�q��%��C%'#�#%��o��C��x�� C�� %�r E�� OTQC�%C��#�� N%##'��%�� N��%�� N��N��R �'�� N�%�� %�FN��%��%��Q%�t�%��C��%��N�� "��%��C�� N� ��F� ��N��C�� p�N��N��#��#%�t%Fww kVC��%�� "��'�s�OTQC�%C��#�� o� �� %��C%''� �� CF��#��%��OTQC�%C��#��"��Fs%��C%'�OTQC�%C��#�� %�� s�"��'��kVC��%�� s� �"��%�� '��x�� C�� %�n1�I1�8,-*4*.+�4*<,*K O�T�%��%'��p�sp�[!��"��q%��C��yx�� C��r E�� OTQC�%C��#�� N�� C��N��N�Q%�t%��C��C"Q� N��Q��%�� p�N��N�� C�%�� ''�O�QC�%C�#�� o� �� "��'� ��C��[ ��'��#��"��'��#�� C#�%� �% ��''�% ��%'� �C��%��%��%'�%��C��"��Fs�O�T�%��%'��p�s��'C� ��"#C��#�� %��"��n1�I1�8,-*4*.+�4*<,*K p�v![��"��q#%��%��C%''�rs��%' E�� OTQC�%C��#�� N��%�� N�#CQ'�� N��NQ%�t�%��C�� N��R �'�� N#% #�� N�"��%'��X N�%�� %�FN�#%��%��'�%��%##'��%�� p�N��N��%��%�� OTQC�%C�� C#�%��%'T��"s�OTQC�%C��#�� VC%��'� �� F��"��F�#%��"#�� N�OTQC�%C�Z�DS� ��"��Fs��#�� %"��%��F �� Z�%C��E��F �X�� C�%��YC%�%�� #�� X'�� D�"#C��C�� "�l��n1�I1�8,-*4*.+�4*<,*K p��!y��"�w�q��%��C%'#�#%��o��C��x�� C�� %�r E�� %��Q��%�� N��N��R �'�� Q'%�t�"%�t��%��%�� %�F��%�� p�N��N��#��#%�t%Fww ��N�C�' �#'%�� C#F�%�� G%'C%Q'��#��%��C ��"�� C##��%��%��%Q'#��N��'%�t ��" ��#��"��Fs��x�� C�� %�

M#�%��T��T��B+*2-,-H�IA*J-�:)1-*>-,12�(195.),/12�(A.)-

Exhibit A Page 1


�� !��"

��# $��!��%�� !��"��&��&#��& �� "#%�!#�# ��

'()*+�,)-./0*12��34/10*05�67/80� 9()++�:;<*1/<<�=>)1<�6)?�@-/A)-)0*>1�� B/C�D><0*12��B/C<*0/�:;*+4*12�� E��F �G�$�� H�"� � I%� ��J�K�H%�J�� L�M��F ��J�K�N��%��F ��" �O��%��J��P%#N�#��K��Q��R�� !��"�R� JJ��K�� !�S4T/-0*</-�U*<V+><;-/$�� %�� M"��"%�� %�� %��%��K ��J�� !�P%��"#%�� #��M ��"#� %�� "��J��W ��"��M�� L��" ��M ��"�!�� "%W�"�� M##��M�� !�� MJ� ��M��%�%J� X��%J�MJ%�� X�� %��%��K �%�L% ��LY��ZM%��%��%��ZM%J��%��%JM%��%JJ��%�� M�� %��%��%��L��%��"#� %�� "%��!�N�"#� %��"%��"#%��#��M�� %��%L�M��%�� #��M�� %##%�!�[��%JJ�#��M�� %�K��%�K��!� JJ��#�� #� �� %��M��!

Exhibit A Page 2


ClassAction.orgThis complaint is part of ClassAction.org's searchable class action lawsuit database and can be found in this post: Lawsuit Removed to Fed. Court Claims Adidas Hack Caused by Inadequate Data Security Systems

https://www.classaction.org/news/lawsuit-removed-to-fed-court-claims-adidas-hack-caused-by-inadequate-data-security-systems

1 DAVID F. MCDOWELL (CA SBN 125806) …...Abrego v. Dow Chem. Co., 443 F.3d 676, 683 (9th Cir....

Documents

Transcript of 1 DAVID F. MCDOWELL (CA SBN 125806) …...Abrego v. Dow Chem. Co., 443 F.3d 676, 683 (9th Cir....